Edit tour

Windows Analysis Report
zmpZMfK1b4.exe

Overview

General Information

Sample name:	zmpZMfK1b4.exe renamed because original name is a hash value
Original sample name:	74609d22f478a3df31034c9f29892da3.exe
Analysis ID:	1589224
MD5:	74609d22f478a3df31034c9f29892da3
SHA1:	d9256eaf50802e49114540f9ee7a7306173c9db8
SHA256:	208afccc1297879ecafd8cc97589c65d5463abb1710c43e81c8df08a4ac8d61a
Tags:	exeMeduzaStealeruser-abuse_ch
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

zmpZMfK1b4.exe (PID: 5796 cmdline: "C:\Users\user\Desktop\zmpZMfK1b4.exe" MD5: 74609D22F478A3DF31034C9F29892DA3)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "62.60.226.62", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "@bebanrti", "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "links": "", "grabber_max_size": 2097152}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
zmpZMfK1b4.exe	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
zmpZMfK1b4.exe	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x1c3d08:$str01: emoji 0x1c65d0:$str02: %d-%m-%Y, %H:%M:%S 0x1c6640:$str03: [UTC 0x1c65b8:$str07: current_path() 0x1c3ce8:$str08: [json.exception. 0x1e2162:$str09: GDI32.dll 0x1e23d4:$str10: GdipGetImageEncoders 0x1e244c:$str10: GdipGetImageEncoders 0x1e19ca:$str11: GetGeoInfoA

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: zmpZMfK1b4.exe PID: 5796	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: zmpZMfK1b4.exe PID: 5796	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.zmpZMfK1b4.exe.7ff7590f0000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.zmpZMfK1b4.exe.7ff7590f0000.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x1c3d08:$str01: emoji 0x1c65d0:$str02: %d-%m-%Y, %H:%M:%S 0x1c6640:$str03: [UTC 0x1c65b8:$str07: current_path() 0x1c3ce8:$str08: [json.exception. 0x1e2162:$str09: GDI32.dll 0x1e23d4:$str10: GdipGetImageEncoders 0x1e244c:$str10: GdipGetImageEncoders 0x1e19ca:$str11: GetGeoInfoA
0.0.zmpZMfK1b4.exe.7ff7590f0000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.0.zmpZMfK1b4.exe.7ff7590f0000.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x1c3d08:$str01: emoji 0x1c65d0:$str02: %d-%m-%Y, %H:%M:%S 0x1c6640:$str03: [UTC 0x1c65b8:$str07: current_path() 0x1c3ce8:$str08: [json.exception. 0x1e2162:$str09: GDI32.dll 0x1e23d4:$str10: GdipGetImageEncoders 0x1e244c:$str10: GdipGetImageEncoders 0x1e19ca:$str11: GetGeoInfoA

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T21:32:03.395669+0100	2049441	1	A Network Trojan was detected	192.168.2.4	49730	62.60.226.62	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T21:32:03.395669+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	62.60.226.62	15666	TCP
2025-01-11T21:32:03.401020+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	62.60.226.62	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T21:32:03.395669+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	62.60.226.62	15666	TCP
2025-01-11T21:32:03.401020+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	62.60.226.62	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: zmpZMfK1b4.exe

Malware Configuration Extractor: Meduza Stealer {"C2 url": "62.60.226.62", "anti_vm": true, "anti_dbg": true, "port": 15666, "build_name": "@bebanrti", "self_destruct": false, "extensions": ".txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite", "links": "", "grabber_max_size": 2097152}

Multi AV Scanner detection for submitted file

Source: zmpZMfK1b4.exe	Virustotal: Detection: 56%			Perma Link
Source: zmpZMfK1b4.exe	ReversingLabs: Detection: 71%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for sample

Source: zmpZMfK1b4.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759164DB0 CryptUnprotectData,LocalFree,	0_2_00007FF759164DB0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591650D0 CryptProtectData,LocalFree,	0_2_00007FF7591650D0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759128910 CryptUnprotectData,LocalFree,_invalid_parameter_noinfo_noreturn,	0_2_00007FF759128910

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: zmpZMfK1b4.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759127AA0 FindFirstFileW,FindNextFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF759127AA0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591DB530 FindClose,FindFirstFileExW,GetLastError,	0_2_00007FF7591DB530
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591DB5E0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_00007FF7591DB5E0

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF759174A60 GetLogicalDriveStringsW,

0_2_00007FF759174A60

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:49730 -> 62.60.226.62:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:49730 -> 62.60.226.62:15666

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 62.60.226.62:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: ASLINE-AS-APASLINELIMITEDHK ASLINE-AS-APASLINELIMITEDHK

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49730 -> 62.60.226.62:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.62

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF759172890 InternetOpenA,InternetOpenUrlA,HttpQueryInfoW,HttpQueryInfoW,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,InternetCloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,

0_2_00007FF759172890

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: zmpZMfK1b4.exe, 00000000.00000003.1882479435.000001D41C430000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1882525851.000001D41C430000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1882630353.000001D41C434000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: zmpZMfK1b4.exe, 00000000.00000003.1682771511.000001D41C421000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi9
Source: zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: zmpZMfK1b4.exe, 00000000.00000002.1883423684.000001D41A71B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/K
Source: zmpZMfK1b4.exe, 00000000.00000002.1883423684.000001D41A71B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/w
Source: zmpZMfK1b4.exe, 00000000.00000003.1700079196.000001D41D24B000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: zmpZMfK1b4.exe, 00000000.00000003.1700079196.000001D41D24B000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: zmpZMfK1b4.exe, 00000000.00000003.1700079196.000001D41D24B000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: zmpZMfK1b4.exe, 00000000.00000003.1700079196.000001D41D24B000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: zmpZMfK1b4.exe, 00000000.00000003.1691508674.000001D41C818000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1697278880.000001D41D7E8000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1689893137.000001D41C810000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1690089255.000001D41C6F4000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1691302517.000001D41C6EC000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1690089255.000001D41C6B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: zmpZMfK1b4.exe, 00000000.00000003.1696398524.000001D41D564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: zmpZMfK1b4.exe, 00000000.00000003.1696398524.000001D41D564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C658000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684907468.000001D41A7ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: zmpZMfK1b4.exe, 00000000.00000003.1684561739.000001D41C5AB000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C60E000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684746997.000001D41D249000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684770228.000001D41C634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C658000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684907468.000001D41A7ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: zmpZMfK1b4.exe, 00000000.00000003.1684561739.000001D41C5AB000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C60E000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684746997.000001D41D249000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684770228.000001D41C634000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: zmpZMfK1b4.exe, 00000000.00000003.1700079196.000001D41D24B000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: zmpZMfK1b4.exe, 00000000.00000003.1700079196.000001D41D24B000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: zmpZMfK1b4.exe, 00000000.00000003.1691508674.000001D41C818000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1697278880.000001D41D7E8000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1689893137.000001D41C810000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1690089255.000001D41C6F4000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1691302517.000001D41C6EC000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1690089255.000001D41C6B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: zmpZMfK1b4.exe, 00000000.00000003.1696398524.000001D41D564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: zmpZMfK1b4.exe, 00000000.00000003.1696398524.000001D41D564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: zmpZMfK1b4.exe, 00000000.00000003.1689893137.000001D41C81F000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1690089255.000001D41C6FB000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1696398524.000001D41D564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: zmpZMfK1b4.exe, 00000000.00000003.1696398524.000001D41D564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: zmpZMfK1b4.exe, 00000000.00000003.1689893137.000001D41C81F000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1690089255.000001D41C6FB000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1696398524.000001D41D564000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF7591731C0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

0_2_00007FF7591731C0

System Summary

Malicious sample detected (through community Yara rule)

Source: zmpZMfK1b4.exe, type: SAMPLE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.2.zmpZMfK1b4.exe.7ff7590f0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.0.zmpZMfK1b4.exe.7ff7590f0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759177C90 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		0_2_00007FF759177C90
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759178390 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,_invalid_parameter_noinfo_noreturn,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,		0_2_00007FF759178390

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759124A50	0_2_00007FF759124A50
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759127AA0	0_2_00007FF759127AA0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75917C9C0	0_2_00007FF75917C9C0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759174D10	0_2_00007FF759174D10
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759121B70	0_2_00007FF759121B70
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591BDBC0	0_2_00007FF7591BDBC0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759173EC0	0_2_00007FF759173EC0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591B2000	0_2_00007FF7591B2000
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75912E240	0_2_00007FF75912E240
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759122260	0_2_00007FF759122260
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591E2268	0_2_00007FF7591E2268
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75914D2B0	0_2_00007FF75914D2B0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75912F2E0	0_2_00007FF75912F2E0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591B3180	0_2_00007FF7591B3180
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591731C0	0_2_00007FF7591731C0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759154200	0_2_00007FF759154200
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759135430	0_2_00007FF759135430
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591696D0	0_2_00007FF7591696D0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591756A0	0_2_00007FF7591756A0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75912D6E0	0_2_00007FF75912D6E0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75919A588	0_2_00007FF75919A588
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591DB5E0	0_2_00007FF7591DB5E0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75916C5E0	0_2_00007FF75916C5E0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591B4890	0_2_00007FF7591B4890
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75912F890	0_2_00007FF75912F890
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759172890	0_2_00007FF759172890
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759188ABC	0_2_00007FF759188ABC
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759198B08	0_2_00007FF759198B08
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591699C3	0_2_00007FF7591699C3
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591849B4	0_2_00007FF7591849B4
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591B89E0	0_2_00007FF7591B89E0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591BBC80	0_2_00007FF7591BBC80
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759122C90	0_2_00007FF759122C90
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759188CC0	0_2_00007FF759188CC0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759191CB8	0_2_00007FF759191CB8
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759162CB0	0_2_00007FF759162CB0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75915FB50	0_2_00007FF75915FB50
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591BFB20	0_2_00007FF7591BFB20
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759128B60	0_2_00007FF759128B60
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591BAB70	0_2_00007FF7591BAB70
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591B1BC0	0_2_00007FF7591B1BC0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591E1BCC	0_2_00007FF7591E1BCC
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759173BA0	0_2_00007FF759173BA0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591B6C00	0_2_00007FF7591B6C00
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75919BE30	0_2_00007FF75919BE30
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759140E80	0_2_00007FF759140E80
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75915FE70	0_2_00007FF75915FE70
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759188EC4	0_2_00007FF759188EC4
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759184EC0	0_2_00007FF759184EC0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759169F00	0_2_00007FF759169F00
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75913DDA0	0_2_00007FF75913DDA0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7590F5DC0	0_2_00007FF7590F5DC0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75919ADF4	0_2_00007FF75919ADF4
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759186DF0	0_2_00007FF759186DF0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75917C090	0_2_00007FF75917C090
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759141070	0_2_00007FF759141070
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591630F0	0_2_00007FF7591630F0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759161F40	0_2_00007FF759161F40
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759142F80	0_2_00007FF759142F80
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7590F8000	0_2_00007FF7590F8000
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75918F268	0_2_00007FF75918F268
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591492D0	0_2_00007FF7591492D0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591682D0	0_2_00007FF7591682D0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591A32E0	0_2_00007FF7591A32E0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759148150	0_2_00007FF759148150
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591601A0	0_2_00007FF7591601A0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75915F200	0_2_00007FF75915F200
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7590F7460	0_2_00007FF7590F7460
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591DE4B0	0_2_00007FF7591DE4B0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591BE500	0_2_00007FF7591BE500
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75915F500	0_2_00007FF75915F500
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75918F384	0_2_00007FF75918F384
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759178390	0_2_00007FF759178390
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591196B0	0_2_00007FF7591196B0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75914C6B0	0_2_00007FF75914C6B0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591786E0	0_2_00007FF7591786E0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591CB540	0_2_00007FF7591CB540
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591B4530	0_2_00007FF7591B4530
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75913F570	0_2_00007FF75913F570
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591575D0	0_2_00007FF7591575D0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591635A6	0_2_00007FF7591635A6
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75912A5AD	0_2_00007FF75912A5AD
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591CA840	0_2_00007FF7591CA840
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591CA820	0_2_00007FF7591CA820
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75915F830	0_2_00007FF75915F830
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759122890	0_2_00007FF759122890
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75916B8B0	0_2_00007FF75916B8B0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7590F78F0	0_2_00007FF7590F78F0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759165760	0_2_00007FF759165760
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75919A804	0_2_00007FF75919A804
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759116800	0_2_00007FF759116800
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75918B810	0_2_00007FF75918B810
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75915B810	0_2_00007FF75915B810
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF75918D7E0	0_2_00007FF75918D7E0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591177F0	0_2_00007FF7591177F0

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: String function: 00007FF75911E1B0 appears 32 times
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: String function: 00007FF759120910 appears 31 times

Source: zmpZMfK1b4.exe, type: SAMPLE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.2.zmpZMfK1b4.exe.7ff7590f0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.0.zmpZMfK1b4.exe.7ff7590f0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF759179910 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

0_2_00007FF759179910

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF75912F2E0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF75912F2E0

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF7591620BE CoCreateInstance,

0_2_00007FF7591620BE

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963DEFD3355

Source: zmpZMfK1b4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: zmpZMfK1b4.exe, 00000000.00000003.1685399100.000001D41C5AA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: zmpZMfK1b4.exe	Virustotal: Detection: 56%
Source: zmpZMfK1b4.exe	ReversingLabs: Detection: 71%

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: zmpZMfK1b4.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: zmpZMfK1b4.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: zmpZMfK1b4.exe

Static file information: File size 2045440 > 1048576

Source: zmpZMfK1b4.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x110c00

Source: zmpZMfK1b4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: zmpZMfK1b4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: zmpZMfK1b4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: zmpZMfK1b4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: zmpZMfK1b4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: zmpZMfK1b4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: zmpZMfK1b4.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: zmpZMfK1b4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: zmpZMfK1b4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: zmpZMfK1b4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: zmpZMfK1b4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: zmpZMfK1b4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: zmpZMfK1b4.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF75912E240 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF75912E240

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF75915B0F9 push rcx; iretd

0_2_00007FF75915B0FC

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF7591696D0 ExitProcess,OpenMutexA,ExitProcess,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7591696D0

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-54146

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF759127AA0 FindFirstFileW,FindNextFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF759127AA0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591DB530 FindClose,FindFirstFileExW,GetLastError,	0_2_00007FF7591DB530
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591DB5E0 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_00007FF7591DB5E0

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF759174A60 GetLogicalDriveStringsW,

0_2_00007FF759174A60

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF7591CC4B0 GetSystemInfo,

0_2_00007FF7591CC4B0

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: zmpZMfK1b4.exe, 00000000.00000002.1883493274.000001D41A760000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000002.1883423684.000001D41A71B000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1683366707.000001D41A779000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

API call chain: ExitProcess graph end node

graph_0-53987

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF759178390 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,_invalid_parameter_noinfo_noreturn,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

0_2_00007FF759178390

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF7591DDBBC GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7591DDBBC

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF7591DDBBC GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7591DDBBC

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

0_2_00007FF75912E240

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591A6360 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF7591A6360
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: 0_2_00007FF7591838D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF7591838D8

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF7591682D0 ShellExecuteW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7591682D0

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF7591A0BB4
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: EnumSystemLocalesW,	0_2_00007FF759194ED8
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF7591A0D98
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_00007FF7591DB1A0
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: GetLocaleInfoW,	0_2_00007FF759195418
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF7591A0350
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7591A06AC
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7591A077C

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF75918AC90 GetSystemTimeAsFileTime,

0_2_00007FF75918AC90

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF7591737A0 GetUserNameW,

0_2_00007FF7591737A0

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Code function: 0_2_00007FF759174D10 GetTimeZoneInformation,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GlobalMemoryStatusEx,wcsftime,GetModuleFileNameA,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF759174D10

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: zmpZMfK1b4.exe PID: 5796, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: zmpZMfK1b4.exe, type: SAMPLE
Source: Yara match	File source: 0.2.zmpZMfK1b4.exe.7ff7590f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.zmpZMfK1b4.exe.7ff7590f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: zmpZMfK1b4.exe PID: 5796, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: zmpZMfK1b4.exe, 00000000.00000002.1883381321.000001D41A71A000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum\wallets
Source: zmpZMfK1b4.exe, 00000000.00000002.1883381321.000001D41A71A000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\wallets
Source: zmpZMfK1b4.exe, 00000000.00000002.1883493274.000001D41A760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: KHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzMl0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K
Source: zmpZMfK1b4.exe, 00000000.00000002.1883381321.000001D41A71A000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: zmpZMfK1b4.exe, 00000000.00000002.1883381321.000001D41A71A000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: zmpZMfK1b4.exe, 00000000.00000002.1883381321.000001D41A71A000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\zmpZMfK1b4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\zmpZMfK1b4.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: zmpZMfK1b4.exe PID: 5796, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: zmpZMfK1b4.exe, type: SAMPLE
Source: Yara match	File source: 0.2.zmpZMfK1b4.exe.7ff7590f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.zmpZMfK1b4.exe.7ff7590f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: zmpZMfK1b4.exe PID: 5796, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Access Token Manipulation	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Email Collection	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Account Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	3 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	24 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
zmpZMfK1b4.exe	57%	Virustotal		Browse
zmpZMfK1b4.exe	71%	ReversingLabs	Win64.Trojan.MeduzaStealer
zmpZMfK1b4.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://ns.microsoft.t/Regi9	0%	Avira URL Cloud	safe
http://ns.microsoft.t/Regi	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	zmpZMfK1b4.exe, 00000000.00000003.1696398524.000001D41D564000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	zmpZMfK1b4.exe, 00000000.00000003.1700079196.000001D41D24B000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org/w	zmpZMfK1b4.exe, 00000000.00000002.1883423684.000001D41A71B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	zmpZMfK1b4.exe, 00000000.00000003.1700079196.000001D41D24B000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	zmpZMfK1b4.exe, 00000000.00000003.1700079196.000001D41D24B000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C658000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684907468.000001D41A7ED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.microsoft.t/Regi9	zmpZMfK1b4.exe, 00000000.00000003.1682771511.000001D41C421000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C658000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684907468.000001D41A7ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	zmpZMfK1b4.exe, 00000000.00000003.1696398524.000001D41D564000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	zmpZMfK1b4.exe, 00000000.00000003.1700079196.000001D41D24B000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	zmpZMfK1b4.exe, 00000000.00000003.1684561739.000001D41C5AB000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C60E000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684746997.000001D41D249000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684770228.000001D41C634000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	zmpZMfK1b4.exe, 00000000.00000003.1691508674.000001D41C818000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1697278880.000001D41D7E8000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1689893137.000001D41C810000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1690089255.000001D41C6F4000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1691302517.000001D41C6EC000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1690089255.000001D41C6B7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	zmpZMfK1b4.exe, 00000000.00000003.1684561739.000001D41C5AB000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C60E000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684746997.000001D41D249000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1684770228.000001D41C634000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ns.microsoft.t/Regi	zmpZMfK1b4.exe, 00000000.00000003.1882479435.000001D41C430000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1882525851.000001D41C430000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1882630353.000001D41C434000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	zmpZMfK1b4.exe, 00000000.00000003.1684264113.000001D41C5FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	zmpZMfK1b4.exe, 00000000.00000003.1700079196.000001D41D24B000.00000004.00000020.00020000.00000000.sdmp, zmpZMfK1b4.exe, 00000000.00000003.1700056024.000001D41A794000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.ipify.org/K	zmpZMfK1b4.exe, 00000000.00000002.1883423684.000001D41A71B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.60.226.62	unknown	Iran (ISLAMIC Republic Of)		18013	ASLINE-AS-APASLINELIMITEDHK	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589224
Start date and time:	2025-01-11 21:31:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zmpZMfK1b4.exe renamed because original name is a hash value
Original Sample Name:	74609d22f478a3df31034c9f29892da3.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 94 Number of non-executed functions: 90
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.74.152	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	malware.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	kAsh3nmsgs.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	dhPWt112uC.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	JuIZye2xKX.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ZeAX5i7cGB.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	jKqPSehspS.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	A6AHI7Uk18.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Wru9ycO2MJ.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	iNFGd6bDZX.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	MyzWeEOlqb.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	5hD3Yjf7xD.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLINE-AS-APASLINELIMITEDHK	rEzX7eqgfo.exe	Get hash	malicious	KeyLogger, StormKitty, VenomRAT	Browse	62.60.226.26
	6.elf	Get hash	malicious	Unknown	Browse	62.60.239.47
	fYT3jJZgOX.exe	Get hash	malicious	Njrat	Browse	154.197.69.14
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	180.223.114.199
	pTvHtQDXio.exe	Get hash	malicious	Amadey	Browse	62.60.226.15
	IGz.arm7.elf	Get hash	malicious	Mirai	Browse	213.176.118.46
	sh4.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	i586.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	x86.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	x32.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
CLOUDFLARENETUS	https://url.us.m.mimecastprotect.com/s/si15COYvJJSRLD3svhDSGbOPs?domain=ejfv5thbb.cc.rs6.net	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://url.us.m.mimecastprotect.com/s/si15COYvJJSRLD3svhDSGbOPs?domain=ejfv5thbb.cc.rs6.net	Get hash	malicious	Unknown	Browse	104.18.95.41
	https://docs.zoom.us/doc/NGIyJXAkRDK0sAtAUh4DFw?from=email	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://ezdrivema.com-payowa.top/i	Get hash	malicious	Unknown	Browse	104.21.1.179
	https://app.heractivatie-portal.net/	Get hash	malicious	Unknown	Browse	104.21.9.2
	https://ville-tonnerre.com/CR_CM/config/information.php?access.x61307366953&&data.x=en_3abae6f9aa37b42f5c9bf622c	Get hash	malicious	Unknown	Browse	104.16.225.240
	Udzp7lL5ns.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	SDIO_R773.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	QsBdpe1gK5.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.21.80.1
	HN1GiQ5tF7.exe	Get hash	malicious	FormBook	Browse	104.21.41.74

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	ix8kxoBHDb.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.67.74.152
	b0cQukXPAl.exe	Get hash	malicious	LummaC	Browse	172.67.74.152
	c7WJL1gt32.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.74.152
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	14lVOjBoI2.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	Qg79mitNvD.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	lkETeneRL3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	AM983ebb5F.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	av8XPPpdBc.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.306439673470683
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	zmpZMfK1b4.exe
File size:	2'045'440 bytes
MD5:	74609d22f478a3df31034c9f29892da3
SHA1:	d9256eaf50802e49114540f9ee7a7306173c9db8
SHA256:	208afccc1297879ecafd8cc97589c65d5463abb1710c43e81c8df08a4ac8d61a
SHA512:	30f3a93f68a2d4e8a8ba0cb3a90abe174860dbd1dc01f42fdd6708f46b94e1394ba0803b1e1478cbcd887e4d09ca15da1706d31fe6227b75cb06cb3b72d464cb
SSDEEP:	49152:kqKuOKE3tn7J8ZsN0zZQQI0qnX9eztpls0uNee:k3nX4lnuF
TLSH:	5B956B66984C12EAD87D9038CE9B4B13F276744443B1D7EB1A9026961FA37E02F3FB54
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........az.N...N...N....x..O....x..O.......W...v...`...v...B...^...F...^...^...^...-....x.......x..D....x..X...N...m....x..S.......Q..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400b6978
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67310ED5 [Sun Nov 10 19:51:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d18aa68269a30cd13693bec0b3505c6a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F1E7080C83Ch
dec eax
add esp, 28h
jmp 00007F1E7080BFDFh
int3
int3
and dword ptr [0013458Dh], 00000000h
ret
dec eax
mov dword ptr [esp+08h], ebx
push ebp
dec eax
lea ebp, dword ptr [esp-000004C0h]
dec eax
sub esp, 000005C0h
mov ebx, ecx
mov ecx, 00000017h
call dword ptr [0005B962h]
test eax, eax
je 00007F1E7080C166h
mov ecx, ebx
int 29h
mov ecx, 00000003h
call 00007F1E7080C129h
xor edx, edx
dec eax
lea ecx, dword ptr [ebp-10h]
inc ecx
mov eax, 000004D0h
call 00007F1E7085329Ch
dec eax
lea ecx, dword ptr [ebp-10h]
call dword ptr [0005B905h]
dec eax
mov ebx, dword ptr [ebp+000000E8h]
dec eax
lea edx, dword ptr [ebp+000004D8h]
dec eax
mov ecx, ebx
inc ebp
xor eax, eax
call dword ptr [0005B8F3h]
dec eax
test eax, eax
je 00007F1E7080C19Eh
dec eax
and dword ptr [esp+38h], 00000000h
dec eax
lea ecx, dword ptr [ebp+000004E0h]
dec eax
mov edx, dword ptr [ebp+000004D8h]
dec esp
mov ecx, eax
dec eax
mov dword ptr [esp+30h], ecx
dec esp
mov eax, ebx
dec eax
lea ecx, dword ptr [ebp+000004E8h]
dec eax
mov dword ptr [esp+28h], ecx
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
mov dword ptr [esp+20h], ecx
xor ecx, ecx
call dword ptr [0005B8BAh]
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e1ca0	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1f6000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1ed000	0x8b2c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1f7000	0x20dc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1c8370	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1c8580	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1c8230	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x112000	0x788	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x110bbc	0x110c00	46f80e4298123619c3387dd9117ea7aa	False	0.4357849736480293	data	6.370311393522564	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x112000	0xd15cc	0xd1600	b7d9e94b988f9eba052be41fd4fc0ce3	False	0.34898670708955226	data	5.617187307821686	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1e4000	0x842c	0x6000	cc40341eb624cb50a08908e13935c1a8	False	0.0880126953125	data	4.5776677164512645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1ed000	0x8b2c	0x8c00	105212294ac2dd0f0f191adea0280e9f	False	0.48800223214285715	PEX Binary Archive	6.071753863991309	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1f6000	0x1e0	0x200	c5a6355ed6a0ad9dc6fe20d45426f2b5	False	0.52734375	data	4.7137725829467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1f7000	0x20dc	0x2200	3560e510ee971a4fd4cc17d066617008	False	0.6786534926470589	data	6.384431292209445	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x1f6060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
WS2_32.dll	WSACleanup, inet_pton, WSAStartup, htons, send, socket, connect, recv, closesocket
CRYPT32.dll	CryptUnprotectData, CryptProtectData
WININET.dll	HttpQueryInfoW, InternetQueryDataAvailable, InternetReadFile, InternetOpenW, InternetOpenUrlA, InternetOpenA, InternetCloseHandle
ntdll.dll	NtQueryObject, RtlReleasePebLock, NtQuerySystemInformation, RtlInitUnicodeString, NtAllocateVirtualMemory, LdrEnumerateLoadedModules, RtlAcquirePebLock
RstrtMgr.DLL	RmGetList, RmStartSession, RmEndSession, RmRegisterResources
KERNEL32.dll	GetFileInformationByHandleEx, FindFirstFileW, FindNextFileW, FindClose, OpenProcess, CreateToolhelp32Snapshot, Process32NextW, LoadLibraryA, Process32FirstW, CloseHandle, GetSystemInfo, GetProcAddress, LocalFree, ReadProcessMemory, FreeLibrary, VirtualQueryEx, GetLastError, ExitProcess, MultiByteToWideChar, WideCharToMultiByte, VirtualFree, VirtualAlloc, ReadFile, WriteFile, CreateFileW, UnmapViewOfFile, GetFileSize, CreateFileMappingW, MapViewOfFile, GetCurrentProcess, VirtualQuery, WriteProcessMemory, GetStdHandle, TerminateProcess, CreateMutexA, ReleaseMutex, OpenMutexA, GetModuleFileNameA, GetVolumeInformationW, GetGeoInfoA, HeapFree, EnterCriticalSection, GetModuleFileNameW, GetProcessId, LeaveCriticalSection, SetFilePointer, InitializeCriticalSectionEx, FreeEnvironmentStringsW, GetModuleHandleA, HeapSize, GetLogicalDriveStringsW, GetFinalPathNameByHandleA, GetTimeZoneInformation, lstrcatW, HeapReAlloc, HeapAlloc, GetUserGeoID, DecodePointer, DeleteCriticalSection, GetProcessHeap, GetModuleHandleW, GetEnvironmentStringsW, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetSystemTimeAsFileTime, VirtualProtect, GetFileSizeEx, SetFilePointerEx, GetCurrentThreadId, GetFileType, GetStartupInfoW, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, GetTempPathW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, LoadLibraryExW, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, ReadConsoleW, RaiseException, SetEndOfFile, GetModuleHandleExW, SetStdHandle, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetStringTypeW, WriteConsoleW, OutputDebugStringW, SetEnvironmentVariableW, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, QueryPerformanceCounter, InitializeSListHead, RtlUnwindEx, RtlUnwind, RtlPcToFileHeader, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InitializeCriticalSection, AreFileApisANSI, GetNativeSystemInfo, TryAcquireSRWLockExclusive, LCMapStringEx, CompareStringEx, GlobalMemoryStatusEx, lstrcpyW, GetCommandLineA, GetCommandLineW, GetComputerNameW, GetFileAttributesExW, GetFileAttributesW, FindFirstFileExW, GetCurrentDirectoryW, GetLocaleInfoEx, FormatMessageA
USER32.dll	EnumDisplayDevicesW, GetDesktopWindow, ReleaseDC, GetSystemMetrics, GetDC, GetWindowRect
GDI32.dll	BitBlt, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetDeviceCaps, DeleteDC, GetObjectW, DeleteObject
ADVAPI32.dll	LookupPrivilegeValueW, AdjustTokenPrivileges, GetCurrentHwProfileW, RegCloseKey, RegGetValueA, RegQueryValueExA, RegOpenKeyExA, GetUserNameW, RegEnumKeyExA, RevertToSelf, ConvertSidToStringSidA, ImpersonateLoggedOnUser, OpenProcessToken, DuplicateTokenEx, GetTokenInformation, CredEnumerateA, CredFree
SHELL32.dll	SHGetKnownFolderPath, ShellExecuteW
ole32.dll	CoUninitialize, CoInitializeSecurity, CoSetProxyBlanket, CoInitializeEx, CoTaskMemFree, CoCreateInstance, CoGetObject
OLEAUT32.dll	SysAllocStringByteLen, SysStringByteLen, SysFreeString
SHLWAPI.dll
gdiplus.dll	GdipFree, GdipDisposeImage, GdipCreateBitmapFromHBITMAP, GdipAlloc, GdipGetImageEncodersSize, GdipCreateBitmapFromScan0, GdipCloneImage, GdipGetImageEncoders, GdiplusShutdown, GdiplusStartup, GdipSaveImageToStream

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T21:32:03.395669+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49730	62.60.226.62	15666	TCP
2025-01-11T21:32:03.395669+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	62.60.226.62	15666	TCP
2025-01-11T21:32:03.395669+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	62.60.226.62	15666	TCP
2025-01-11T21:32:03.401020+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	62.60.226.62	15666	TCP
2025-01-11T21:32:03.401020+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	62.60.226.62	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 21:31:58.429950953 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:31:58.435098886 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:31:58.435190916 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:31:58.500978947 CET	49731	443	192.168.2.4	172.67.74.152
Jan 11, 2025 21:31:58.501054049 CET	443	49731	172.67.74.152	192.168.2.4
Jan 11, 2025 21:31:58.501537085 CET	49731	443	192.168.2.4	172.67.74.152
Jan 11, 2025 21:31:58.524570942 CET	49731	443	192.168.2.4	172.67.74.152
Jan 11, 2025 21:31:58.524606943 CET	443	49731	172.67.74.152	192.168.2.4
Jan 11, 2025 21:31:59.010615110 CET	443	49731	172.67.74.152	192.168.2.4
Jan 11, 2025 21:31:59.010694981 CET	49731	443	192.168.2.4	172.67.74.152
Jan 11, 2025 21:31:59.059655905 CET	49731	443	192.168.2.4	172.67.74.152
Jan 11, 2025 21:31:59.059698105 CET	443	49731	172.67.74.152	192.168.2.4
Jan 11, 2025 21:31:59.060084105 CET	443	49731	172.67.74.152	192.168.2.4
Jan 11, 2025 21:31:59.060143948 CET	49731	443	192.168.2.4	172.67.74.152
Jan 11, 2025 21:31:59.061165094 CET	49731	443	192.168.2.4	172.67.74.152
Jan 11, 2025 21:31:59.103346109 CET	443	49731	172.67.74.152	192.168.2.4
Jan 11, 2025 21:31:59.191863060 CET	443	49731	172.67.74.152	192.168.2.4
Jan 11, 2025 21:31:59.191935062 CET	443	49731	172.67.74.152	192.168.2.4
Jan 11, 2025 21:31:59.191936970 CET	49731	443	192.168.2.4	172.67.74.152
Jan 11, 2025 21:31:59.191993952 CET	49731	443	192.168.2.4	172.67.74.152
Jan 11, 2025 21:31:59.192147017 CET	49731	443	192.168.2.4	172.67.74.152
Jan 11, 2025 21:31:59.192178011 CET	443	49731	172.67.74.152	192.168.2.4
Jan 11, 2025 21:32:03.395668983 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.400903940 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.400944948 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.400981903 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.401001930 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.401020050 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.401031971 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.401053905 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.401060104 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.401087999 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.401094913 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.401117086 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.401129961 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.401145935 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.401161909 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.401175022 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.401194096 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.401211977 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.401261091 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.401294947 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.406128883 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406157970 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406210899 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406212091 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.406238079 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406271935 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406272888 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.406301975 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.406322956 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406326056 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.406371117 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406395912 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.406398058 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406439066 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406459093 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.406502962 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406506062 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.406549931 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406574965 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.406579971 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406610012 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.406627893 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.406649113 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.406702042 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.411412954 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.411487103 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.411588907 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.411648989 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.411652088 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.411684036 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.411731958 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.411843061 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.411876917 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.411902905 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.411920071 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.411963940 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412003994 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412065029 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412173986 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412201881 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412229061 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412246943 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412256002 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412278891 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412282944 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412301064 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412323952 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412332058 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412359953 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412385941 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412400007 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412412882 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412437916 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412441015 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412467003 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412471056 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412497044 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412513971 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412523985 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412542105 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412571907 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412586927 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412599087 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412615061 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412626982 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412652969 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412655115 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412679911 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412697077 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412708044 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412723064 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412734985 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.412755966 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.412784100 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.416357040 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.416424036 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.416429996 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.416491032 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.416584015 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.416611910 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.416637897 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.416640997 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.416668892 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.416701078 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.416749954 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.416776896 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.416814089 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.416847944 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.416909933 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.416937113 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.416975021 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417002916 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417002916 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417032003 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417057991 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417059898 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417084932 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417098045 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417135000 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417138100 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417165995 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417191982 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417197943 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417217970 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417236090 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417247057 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417277098 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417277098 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417298079 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417304993 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417324066 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417349100 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417773962 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417803049 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417829037 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417843103 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417856932 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417885065 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417886972 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417912006 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417912960 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417937994 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417939901 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417967081 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.417985916 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.417992115 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418013096 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418040037 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418054104 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418066025 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418112040 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418119907 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418148994 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418174028 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418185949 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418200970 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418242931 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418251991 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418268919 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418281078 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418308020 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418313026 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418332100 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418339968 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418358088 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418386936 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418389082 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418416023 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418443918 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418457031 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418469906 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418489933 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418512106 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418519974 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418548107 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418574095 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418598890 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418618917 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418625116 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418652058 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418654919 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418683052 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418699026 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418709993 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418726921 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418754101 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418765068 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418781042 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418797016 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418807983 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418817997 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418833971 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418860912 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418864965 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418886900 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418891907 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418916941 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418925047 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418945074 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.418951988 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418986082 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.418992996 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.419022083 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.419048071 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.419063091 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.419075012 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.419091940 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.419102907 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.419131041 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.419137001 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.419157028 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.419178963 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.419183969 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.419205904 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.419210911 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.419239044 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.419244051 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.419270039 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.419295073 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.421250105 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.421319008 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.421396017 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.421423912 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.421466112 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.421555996 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.421582937 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.421608925 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.421622038 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.421641111 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.421649933 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.421686888 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.421752930 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.421780109 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.421806097 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.421813965 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.421832085 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.421853065 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.421864033 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.421879053 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.421911955 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422211885 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422239065 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422280073 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422287941 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422317028 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422343016 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422358036 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422390938 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422390938 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422420025 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422447920 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422451973 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422481060 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422503948 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422543049 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422574043 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422616005 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422621012 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422650099 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422679901 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422679901 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422708035 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422729969 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422733068 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422759056 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422785997 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422808886 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422836065 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422836065 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422864914 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422908068 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422913074 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422940016 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422966003 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422966957 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.422992945 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.422992945 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.423018932 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.423041105 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.423043966 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.423069000 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.423094988 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.423098087 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.423125029 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.423150063 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424036980 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424103022 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424186945 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424246073 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424252987 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424318075 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424392939 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424421072 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424458027 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424472094 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424485922 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424499989 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424534082 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424561977 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424688101 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424715996 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424770117 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424774885 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424797058 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424823999 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424841881 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424851894 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424874067 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424896002 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424901009 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424927950 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424953938 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424954891 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.424981117 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.424983025 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425007105 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425029039 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425029039 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425057888 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425107002 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425123930 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425153017 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425182104 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425200939 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425210953 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425228119 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425247908 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425271988 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425276995 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425304890 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425332069 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425335884 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425359011 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425376892 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425386906 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425410032 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425431013 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425436020 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425463915 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425489902 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425494909 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425517082 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425529957 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425544977 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425563097 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425574064 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425587893 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425601959 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425627947 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425628901 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425657034 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425661087 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425684929 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425704956 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425710917 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425734043 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425760984 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425765038 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425786972 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425791025 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425815105 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425817013 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425843000 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425843000 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425868988 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425868988 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425894976 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425900936 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425920963 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425930023 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425949097 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425951004 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.425976038 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.425977945 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426002979 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426018953 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426031113 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426058054 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426074028 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426084042 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426105022 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426116943 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426132917 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426157951 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426165104 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426177025 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426188946 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426199913 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426211119 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426212072 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426223040 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426234961 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426246881 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426246881 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426259041 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426271915 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426280975 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426285982 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426291943 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426296949 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426301956 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426312923 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426320076 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426323891 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426337004 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426350117 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426372051 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426384926 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426393986 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426394939 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426405907 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426419020 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426429987 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426435947 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426448107 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426455975 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426459074 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426482916 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426495075 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426506996 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426512003 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426512957 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426517010 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426537037 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426546097 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426548958 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426561117 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426585913 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426605940 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426608086 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426620007 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426651001 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426651001 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426662922 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426675081 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426692963 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426696062 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426708937 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426721096 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426737070 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426742077 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426754951 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426765919 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426765919 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426779985 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.426805019 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.426834106 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.427042007 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427053928 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427107096 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.427117109 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427150011 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427169085 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427170038 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.427212000 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.427218914 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427263021 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427268028 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.427275896 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427319050 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427333117 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.427344084 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427390099 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.427561998 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427575111 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427596092 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427608013 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427619934 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427624941 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.427630901 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427643061 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427649021 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427654028 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427659035 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427665949 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.427669048 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427692890 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427704096 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427716970 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427735090 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.427738905 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427752018 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427803040 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.427917004 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427973032 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.427974939 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.428025961 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.428062916 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428075075 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428122997 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.428212881 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428225994 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428246975 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428258896 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428277969 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.428281069 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428293943 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428311110 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.428333044 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428347111 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428349018 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.428359032 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428371906 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428392887 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428405046 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428410053 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.428416014 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428453922 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.428827047 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428839922 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428888083 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428900957 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.428903103 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.428934097 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.428953886 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.428975105 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429013968 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429040909 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429069042 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429069996 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429095030 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429117918 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429153919 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429157019 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429171085 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429220915 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429229021 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429233074 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429255009 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429260015 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429266930 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429284096 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429305077 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429311037 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429316998 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429347992 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429359913 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429373026 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429375887 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429415941 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429419041 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429429054 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429475069 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429568052 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429579973 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429590940 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429601908 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429613113 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429624081 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429636955 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429639101 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429649115 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429673910 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429686069 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429697037 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429697990 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429708004 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429729939 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429742098 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429745913 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429754019 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429766893 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429775953 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429789066 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429801941 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429822922 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429853916 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429866076 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429878950 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429892063 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.429919004 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.429944038 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.431438923 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.431493998 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.431658030 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.431699038 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.431711912 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.431755066 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.431822062 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.431834936 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.431879044 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.431973934 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.431987047 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432039022 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432043076 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432060957 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432097912 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432125092 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432188988 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432200909 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432246923 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432255030 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432298899 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432300091 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432346106 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432351112 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432364941 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432411909 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432502031 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432514906 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432526112 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432537079 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432548046 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432565928 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432569981 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432583094 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432596922 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432610035 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432646036 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432667017 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432678938 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432715893 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432784081 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432796001 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432826042 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432871103 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432885885 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432898998 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.432948112 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.432992935 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433005095 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433034897 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433073044 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433113098 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433135986 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433147907 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433159113 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433203936 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433263063 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433274984 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433310032 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433341980 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433360100 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433372021 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433414936 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433465958 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433487892 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433511972 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433553934 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433583021 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433594942 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433621883 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433625937 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433650970 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433650970 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433676004 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433712006 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433760881 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433815956 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433820963 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433866978 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433938980 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.433985949 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.433989048 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.434032917 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.434103966 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.434115887 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.434154987 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.434156895 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.434168100 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.434199095 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.434225082 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.475178957 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.475457907 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.475542068 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.475610971 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.475670099 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.475735903 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.475809097 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.475864887 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.475928068 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.475980043 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.476049900 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.476104021 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.476172924 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.476214886 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.490891933 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.491048098 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.491133928 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.491193056 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.491266012 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.491296053 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.496187925 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.496398926 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.496481895 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.496527910 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.542988062 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.543046951 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.590171099 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.590341091 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.590749025 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.590862989 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.590935946 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.591020107 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.591094017 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.591186047 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.591254950 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.591351986 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.591398954 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.595453978 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.595671892 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.595777035 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.595827103 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.639111042 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.639287949 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.667236090 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.667644978 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.667862892 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.667984009 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.668107033 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.673463106 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.673696041 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.673868895 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.673949957 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.720050097 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.720237017 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.730339050 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.730473995 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.730592012 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.730772972 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.730865955 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.731014967 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.731127024 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.731236935 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.731345892 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.731456995 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.731492996 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.735627890 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.735805035 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.778959990 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.779134989 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.807205915 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.807238102 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.807421923 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.807446003 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.807626009 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.807727098 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.807853937 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.807950974 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.808145046 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.808260918 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.808377028 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.808479071 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.808598042 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.808700085 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.808844090 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.808950901 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.809082985 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.809144020 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.855019093 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.855319023 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.855521917 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.855700970 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.855818987 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.870028019 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.870273113 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.870421886 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.870522976 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.870659113 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.870759964 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.870898008 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.870996952 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.871114016 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.871215105 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.871332884 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.871454954 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.871608019 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.871704102 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.871829987 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.871908903 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875335932 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875366926 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875396013 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875415087 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875447035 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875452995 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875474930 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875502110 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875507116 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875529051 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875538111 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875571966 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875580072 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875607967 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875637054 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875643969 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875664949 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875680923 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875711918 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875714064 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875741959 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875767946 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875786066 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875796080 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875816107 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875823021 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875840902 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875849962 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875873089 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875876904 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875900984 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875904083 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875927925 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875956059 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.875957966 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.875983000 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876008987 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876028061 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876035929 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876069069 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876070976 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876096010 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876101017 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876121044 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876143932 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876171112 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876199007 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876233101 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876260996 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876290083 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876317978 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876346111 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876374960 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876379013 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876403093 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876427889 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876430035 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876457930 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876456976 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876487017 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876487017 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876498938 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876512051 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876522064 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876523972 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876535892 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876548052 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876555920 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876559973 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876571894 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876584053 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876595020 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876602888 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876606941 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876619101 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876631021 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876642942 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876658916 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876668930 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876682997 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876694918 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876705885 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876710892 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876718044 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876730919 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876741886 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876745939 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876754045 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876766920 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876779079 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876790047 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876791000 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876801014 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876812935 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876825094 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876840115 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876846075 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876858950 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876871109 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876883030 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876888990 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876893997 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876907110 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876919031 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876930952 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876940966 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876954079 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876966953 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876977921 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.876986027 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.876991034 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877022982 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877027035 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877036095 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877065897 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877088070 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877100945 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877145052 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877162933 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877176046 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877226114 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877226114 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877239943 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877254963 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877289057 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877291918 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877322912 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877330065 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877343893 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877353907 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877366066 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877378941 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877382040 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877403021 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877414942 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877463102 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877480030 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877491951 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877504110 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877516985 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877533913 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877537012 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877549887 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877564907 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877573013 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877585888 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877597094 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877634048 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877638102 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877645969 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877675056 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877675056 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877688885 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877710104 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877727032 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877732992 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877738953 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877760887 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877770901 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877774954 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877806902 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877820969 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877831936 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877852917 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877877951 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.877948999 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877962112 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.877993107 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878001928 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878005028 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878036022 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878040075 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878057003 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878067017 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878083944 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878094912 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878096104 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878118992 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878129959 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878134966 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878153086 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878165007 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878165960 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878186941 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878200054 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878211975 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878232002 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878243923 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878253937 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878278971 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878304958 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878309965 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878324986 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878357887 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878360033 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878396034 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878405094 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878420115 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878432989 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878439903 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878474951 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878492117 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878504992 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878516912 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878537893 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878549099 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878555059 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878561020 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878582954 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878595114 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878596067 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878616095 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878629923 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878633022 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878652096 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878667116 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878678083 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878679991 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878703117 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878705978 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878731012 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878736019 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878770113 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878772974 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878813028 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878854990 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878866911 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878899097 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878906965 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878912926 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878936052 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878947973 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.878948927 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.878988981 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879003048 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879015923 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879049063 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879054070 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879061937 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879084110 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879095078 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879098892 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879138947 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879225969 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879240036 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879278898 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879297972 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879359007 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879359007 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879371881 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879393101 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879399061 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879407883 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879419088 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879440069 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879445076 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879487991 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879488945 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879501104 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879523993 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879530907 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879535913 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879559040 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879568100 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879570961 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879594088 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879606009 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879610062 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879620075 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879647970 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879653931 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879673004 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879702091 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879746914 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879760027 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879795074 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879808903 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879822016 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879833937 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879846096 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879863977 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879868031 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879880905 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879892111 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879906893 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879935980 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.879978895 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.879991055 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880014896 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880027056 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880028009 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880038977 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880059958 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880064964 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880072117 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880095005 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880105972 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880115986 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880121946 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880127907 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880148888 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880161047 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880183935 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880217075 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880235910 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880248070 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880261898 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880284071 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880294085 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880297899 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880310059 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880326986 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880336046 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880348921 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880388021 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880395889 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880409956 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880431890 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880434036 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880444050 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880465984 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880470037 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880479097 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880498886 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880527020 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880546093 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880559921 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880594015 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880601883 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880605936 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880630016 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880641937 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880664110 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880666018 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880676031 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880688906 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880695105 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880700111 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880723000 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880733013 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880734921 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880745888 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880758047 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880776882 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880779982 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880793095 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880805969 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880811930 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880817890 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880841017 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880848885 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880852938 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880875111 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880878925 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880887985 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880903959 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880916119 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880928993 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880963087 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880964041 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.880975962 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.880996943 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881010056 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881015062 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881047010 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881091118 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881103039 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881150961 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881153107 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881164074 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881186008 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881196976 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881205082 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881218910 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881231070 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881242037 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881269932 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881275892 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881288052 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881319046 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881330013 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881330967 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881360054 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881369114 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881381989 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881386042 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881402969 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881413937 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881423950 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881453991 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881477118 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881489992 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881510019 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881520987 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881535053 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881567955 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881609917 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881622076 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881647110 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881659031 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881659031 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881680965 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881692886 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881695986 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881704092 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881716967 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881731987 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881738901 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881752014 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881763935 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881778955 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881779909 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881793976 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881814957 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881827116 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881830931 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881838083 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881860971 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881872892 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881876945 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881913900 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.881922960 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881936073 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.881984949 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882014990 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882026911 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882049084 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882060051 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882061958 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882081032 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882088900 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882093906 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882108927 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882129908 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882158995 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882164001 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882177114 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882188082 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882203102 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882208109 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882220984 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882231951 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882232904 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882246017 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882277966 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882292986 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882306099 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882307053 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882335901 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882340908 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882350922 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882374048 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882380009 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882391930 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882396936 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882426977 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882437944 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882452965 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882484913 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882496119 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882498026 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882523060 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882540941 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882546902 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882555008 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882576942 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882582903 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882589102 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882612944 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882642031 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882678986 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882692099 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882713079 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882724047 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.882733107 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.882780075 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.895236969 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.895256042 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.895270109 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.895488024 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.895673990 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.895803928 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.895889997 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.896035910 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.896055937 CET	15666	49730	62.60.226.62	192.168.2.4
Jan 11, 2025 21:32:03.896233082 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.896306038 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.896354914 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.896513939 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.896667004 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.896760941 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.896879911 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.896966934 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.897077084 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.897167921 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.897305012 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.897408009 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.897542000 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.897644997 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.897772074 CET	49730	15666	192.168.2.4	62.60.226.62
Jan 11, 2025 21:32:03.897845030 CET	49730	15666	192.168.2.4	62.60.226.62

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 21:31:58.489387989 CET	192.168.2.4	1.1.1.1	0x9d60	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 21:31:58.496197939 CET	1.1.1.1	192.168.2.4	0x9d60	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 11, 2025 21:31:58.496197939 CET	1.1.1.1	192.168.2.4	0x9d60	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 11, 2025 21:31:58.496197939 CET	1.1.1.1	192.168.2.4	0x9d60	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	172.67.74.152	443	5796	C:\Users\user\Desktop\zmpZMfK1b4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 20:31:59 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2025-01-11 20:31:59 UTC	424	IN	HTTP/1.1 200 OK Date: Sat, 11 Jan 2025 20:31:59 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 9007ac6a7bdd42f2-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1719&min_rtt=1701&rtt_var=674&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2820&recv_bytes=738&delivery_rate=1580942&cwnd=222&unsent_bytes=0&cid=9a5b1aeae546b69f&ts=195&x=0"
2025-01-11 20:31:59 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	15:31:57
Start date:	11/01/2025
Path:	C:\Users\user\Desktop\zmpZMfK1b4.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\zmpZMfK1b4.exe"
Imagebase:	0x7ff7590f0000
File size:	2'045'440 bytes
MD5 hash:	74609D22F478A3DF31034C9F29892DA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	39.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	67

Executed Functions

Function 00007FF759174D10 Relevance: 63.9, APIs: 33, Strings: 2, Instructions: 2660timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00007FF759175040
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759175650
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759175656
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917565C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759175662
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759175668
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917566E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759175674
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917567A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759175680
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759175686
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917568C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591759DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591759EA
GlobalMemoryStatusEx.KERNEL32 ref: 00007FF75917618C

Strings

[UTC, xrefs: 00007FF759175013
%d-%m-%Y, %H:%M:%S, xrefs: 00007FF759176BBB

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$GlobalInformationMemoryStatusTimeZone
String ID: %d-%m-%Y, %H:%M:%S$[UTC
API String ID: 3879215917-1656529043
Opcode ID: 007bacec43bf8442acc4a51b7d892edd5634294ffc0104361aac2e1d405d84e4
Instruction ID: 4d0097e63e71ccb69fc58587a8550b058b548c9248382df1dc58582232b2332f
Opcode Fuzzy Hash: 007bacec43bf8442acc4a51b7d892edd5634294ffc0104361aac2e1d405d84e4
Instruction Fuzzy Hash: 2A53C233A18BD589EB20DF64E8402EDB7B1F789798F844225EA9D17B99DF38D540C350

Function 00007FF75914D2B0 Relevance: 57.4, APIs: 26, Strings: 6, Instructions: 1378
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

directory_iterator::directory_iterator, xrefs: 00007FF7591517B3, 00007FF7591517D5, 00007FF75915180D, 00007FF759153C01
recursive_directory_iterator::operator++, xrefs: 00007FF7591515D8, 00007FF7591516A5, 00007FF759151768
recursive_directory_iterator::recursive_directory_iterator, xrefs: 00007FF7591515EF, 00007FF759151629, 00007FF75915177F
exists, xrefs: 00007FF75915153E, 00007FF75915160C, 00007FF7591516CE, 00007FF75915179C, 00007FF759153BEE, 00007FF759153F77, 00007FF759153F8C
cannot use push_back() with , xrefs: 00007FF759151585, 00007FF75915165E, 00007FF759151715
status, xrefs: 00007FF759151560, 00007FF759151639, 00007FF7591516F0, 00007FF7591517C3, 00007FF7591517E5, 00007FF7591517FB, 00007FF75915181D, 00007FF759153C17

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 3645842244-1862120484
Opcode ID: 38f6435d5c4f103796c93540da24862deabf6792b336eb1dbb538c525db28cf3
Instruction ID: b6fc2d0042977efe4e96890430a3007aa2015c1e2fc2b21b10d84f00fff123c5
Opcode Fuzzy Hash: 38f6435d5c4f103796c93540da24862deabf6792b336eb1dbb538c525db28cf3
Instruction Fuzzy Hash: 99E23872918BC985EA709F19F8802AAF3B0F788784F545225EACD57B59EF3CD254CB10

Function 00007FF7591731C0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 227
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00007FF759173201
GetSystemMetrics.USER32 ref: 00007FF75917320F
GetSystemMetrics.USER32 ref: 00007FF75917321D
GetSystemMetrics.USER32 ref: 00007FF75917322B
GetDC.USER32 ref: 00007FF759173235
GetDeviceCaps.GDI32 ref: 00007FF75917324B
GetDeviceCaps.GDI32 ref: 00007FF75917325B
CreateCompatibleDC.GDI32 ref: 00007FF759173268
CreateCompatibleBitmap.GDI32 ref: 00007FF759173280
SelectObject.GDI32 ref: 00007FF759173296
BitBlt.GDI32 ref: 00007FF7591732CC
SHCreateMemStream.SHLWAPI ref: 00007FF759173302
SelectObject.GDI32 ref: 00007FF759173318
DeleteDC.GDI32 ref: 00007FF759173321
ReleaseDC.USER32 ref: 00007FF75917332C
DeleteObject.GDI32 ref: 00007FF759173335
EnterCriticalSection.KERNEL32 ref: 00007FF75917342C
LeaveCriticalSection.KERNEL32 ref: 00007FF75917343E
IStream_Size.SHLWAPI ref: 00007FF759173475
IStream_Reset.SHLWAPI ref: 00007FF759173486
IStream_Read.SHLWAPI ref: 00007FF759173513
SelectObject.GDI32 ref: 00007FF75917356D
DeleteDC.GDI32 ref: 00007FF759173576
ReleaseDC.USER32 ref: 00007FF759173583
DeleteObject.GDI32 ref: 00007FF75917358C

Strings

, xrefs: 00007FF7591732A1

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: 4570f9383e84002ac9607ad730a0e941a27e690350746800c8a63a8a9ddeccf0
Instruction ID: b66afcd40f7b35811f1b775e601dc3c487967152c8cbea10ae5a2e82e11615ad
Opcode Fuzzy Hash: 4570f9383e84002ac9607ad730a0e941a27e690350746800c8a63a8a9ddeccf0
Instruction Fuzzy Hash: 5DB13F62A08BC186E760EF21F4543AAB7B5FB99780F848535DA8D43B55DF3CD485CB10

Function 00007FF7591B3180 Relevance: 43.1, APIs: 9, Strings: 15, Instructions: 1071
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44A9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44AF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44B5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44CD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44D3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44D9

Strings

UNKNOWN, xrefs: 00007FF7591B38FC
Original function:, xrefs: 00007FF7591B34DF
m_trampoline: , xrefs: 00007FF7591B3E06
Hook size: , xrefs: 00007FF7591B4236
Chosen detour scheme: , xrefs: 00007FF7591B392A
ions, xrefs: 00007FF7591B379D
Prologue offset: , xrefs: 00007FF7591B42C8
m_fnAddress: , xrefs: 00007FF7591B320A, 00007FF7591B3274
Hook instructions: , xrefs: 00007FF7591B4140
failed, xrefs: 00007FF7591B383F
one, xrefs: 00007FF7591B3C30
Trampoline Jmp Tbl:, xrefs: 00007FF7591B408A
Trampoline:, xrefs: 00007FF7591B3F7D
Prologue to overwrite:, xrefs: 00007FF7591B3CB1
m_trampolineSz: , xrefs: 00007FF7591B3EAA

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: one$Chosen detour scheme: $Hook instructions: $Hook size: $Original function:$Prologue offset: $Prologue to overwrite:$Trampoline Jmp Tbl:$Trampoline:$UNKNOWN$failed$ions$m_fnAddress: $m_trampoline: $m_trampolineSz:
API String ID: 3668304517-2571529286
Opcode ID: 3ccd86010bd4db3d21a5f95ce0cbf476ba86f1419509c969db7480cc75890916
Instruction ID: 35de525def3eb1a2ec2640a213432e797e67ec7de9c08f31091ac702c7b045c5
Opcode Fuzzy Hash: 3ccd86010bd4db3d21a5f95ce0cbf476ba86f1419509c969db7480cc75890916
Instruction Fuzzy Hash: FFB29762A18BD185EB21EF34E8413EDB372FB95788F845232DA4D07696DF78E685C310

Function 00007FF7591B2000 Relevance: 41.2, APIs: 9, Strings: 14, Instructions: 900COMMON

Download Yara Rule

Strings

mov , xrefs: 00007FF7591B2830
lea rsp, [rsp - 0x80], xrefs: 00007FF7591B2243
pop , xrefs: 00007FF7591B2B94, 00007FF7591B2BC5
AsmTK error: , xrefs: 00007FF7591B2DCD
Translation address: , xrefs: 00007FF7591B2E92
, xrefs: 00007FF7591B2AA1
AsmJit error: , xrefs: 00007FF7591B2E48
], , xrefs: 00007FF7591B2B2F
invalid map<K, T> key, xrefs: 00007FF7591B2F61
push , xrefs: 00007FF7591B2295, 00007FF7591B2427
ret , xrefs: 00007FF7591B1E67, 00007FF7591B1ED4, 00007FF7591B2009
mov [, xrefs: 00007FF7591B2B1B
, [, xrefs: 00007FF7591B2858
Translation:, xrefs: 00007FF7591B2D1D

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID: $, [$AsmJit error: $AsmTK error: $Translation address: $Translation:$], $invalid map<K, T> key$lea rsp, [rsp - 0x80]$mov $mov [$pop $push $ret
API String ID: 0-682514236
Opcode ID: 2ec50bdac201dc851adf0de9c64dfe710cdd040a4f0a2fe34fcc99ef2f03135e
Instruction ID: eae884ee69f75220ef7e6899a8412374a90c7692adc6c8065a0636bb55a9d5de
Opcode Fuzzy Hash: 2ec50bdac201dc851adf0de9c64dfe710cdd040a4f0a2fe34fcc99ef2f03135e
Instruction Fuzzy Hash: 9F92B662A08BD585EF21EF34E8403EDA372FB55388F845631DA5C4BA9ADF78D685C310

Function 00007FF7591B4530 Relevance: 36.5, APIs: 12, Strings: 8, Instructions: 1457COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B4869
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591B486F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B4875
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B487B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B5B55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B5B5B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B5B61
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B5B67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B5B6D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B5EE9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591B5EEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B5EF5

Strings

Instructions needing entry:, xrefs: 00007FF7591B4A3C
Instructions needing relocation:, xrefs: 00007FF7591B4B9E
jmp, xrefs: 00007FF7591B4594
m_fnAddress: , xrefs: 00007FF7591B489E
Trampoline address: , xrefs: 00007FF7591B4F8D
Original function:, xrefs: 00007FF7591B489C
Instructions needing translation:, xrefs: 00007FF7591B4E7B
Jmp To Prol:, xrefs: 00007FF7591B577E, 00007FF7591B5B86

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: Instructions needing entry:$Instructions needing relocation:$Instructions needing translation:$Jmp To Prol:$Original function:$Trampoline address: $jmp$m_fnAddress:
API String ID: 3936042273-1617887432
Opcode ID: f3f86b5cb0a87ddbe915c5c4f3e8896dc128ce3eb568e54f2f2d22fbfba82f04
Instruction ID: 4fce1737c222fd6f777ebdbe9a220d9c0d9e23e9674b7b3e9bf661139b7d68c6
Opcode Fuzzy Hash: f3f86b5cb0a87ddbe915c5c4f3e8896dc128ce3eb568e54f2f2d22fbfba82f04
Instruction Fuzzy Hash: CBE2AE62A08BD189EF20EF64E4443EDA372EB55798F885232DA5D07BDADF78D584C310

Function 00007FF75912E240 Relevance: 35.9, APIs: 17, Strings: 3, Instructions: 862
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF75912E32C
GetProcAddress.KERNEL32 ref: 00007FF75912E437
GetProcAddress.KERNEL32 ref: 00007FF75912E4F9
GetProcAddress.KERNEL32 ref: 00007FF75912E573
GetProcAddress.KERNEL32 ref: 00007FF75912E5F5
GetProcAddress.KERNEL32 ref: 00007FF75912E66F
GetProcAddress.KERNEL32 ref: 00007FF75912E6F3
FreeLibrary.KERNEL32 ref: 00007FF75912F221
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F2AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F2B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F2B7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F2BD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F2C3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F2C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F2CF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F2D5

Strings

system, xrefs: 00007FF75912F02D
vault, xrefs: 00007FF75912F083
cannot use push_back() with , xrefs: 00007FF75912F26F

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2463004387-1741236777
Opcode ID: 05d2e61f9fa580f84d7d12ca1f246b1bc00d86d634c62b345fbc85d4ed68ddb5
Instruction ID: bff5f9dd34cef20bc381437dd4f2f812d257756acf3b76df93fa3e2f14e08a41
Opcode Fuzzy Hash: 05d2e61f9fa580f84d7d12ca1f246b1bc00d86d634c62b345fbc85d4ed68ddb5
Instruction Fuzzy Hash: 4F926C32609BC589EB609F25E8843EDB3B4F749798F544226EB9C47B99EF39D644C300

Function 00007FF7591B4890 Relevance: 34.4, APIs: 12, Strings: 7, Instructions: 1164COMMON

Download Yara Rule

Strings

Instructions needing entry:, xrefs: 00007FF7591B4A3C
Instructions needing relocation:, xrefs: 00007FF7591B4B9E
m_fnAddress: , xrefs: 00007FF7591B489E
Trampoline address: , xrefs: 00007FF7591B4F8D
Original function:, xrefs: 00007FF7591B489C
Instructions needing translation:, xrefs: 00007FF7591B4E7B
Jmp To Prol:, xrefs: 00007FF7591B577E, 00007FF7591B5B86

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID: Instructions needing entry:$Instructions needing relocation:$Instructions needing translation:$Jmp To Prol:$Original function:$Trampoline address: $m_fnAddress:
API String ID: 0-38338247
Opcode ID: 26f5bcde2b71b93b35c110bb7241ee112181efc3a198ccf69ac9b6c280090035
Instruction ID: 0da7631c31818809533b0479af82a397136037a640b4e22868a98ef441fa7c15
Opcode Fuzzy Hash: 26f5bcde2b71b93b35c110bb7241ee112181efc3a198ccf69ac9b6c280090035
Instruction Fuzzy Hash: 3DC29E22A08BD589EF20EF24E4443EDA372FB55798F985232DA5D07B9ADF78D584C310

Function 00007FF759127AA0 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 797
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32 ref: 00007FF759127B7F
FindNextFileW.KERNELBASE ref: 00007FF759128366
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591283D0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591283D5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591283DB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591283E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591283E6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591284A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591284AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912876C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759128787
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591288FF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759128905

Strings

content, xrefs: 00007FF75912824F
exists, xrefs: 00007FF75912877A
filename, xrefs: 00007FF75912815A

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileFind$FirstNext
String ID: content$exists$filename
API String ID: 4266024580-1949714836
Opcode ID: 1695b9e4f29f96d3cc302258a962b42ccbc65fc78b56339fecc86d30533bbb36
Instruction ID: a85fc2bfccb0b6079dba3a2a118e2fc8cd759215cc6f73e015f464844e5ccb96
Opcode Fuzzy Hash: 1695b9e4f29f96d3cc302258a962b42ccbc65fc78b56339fecc86d30533bbb36
Instruction Fuzzy Hash: CC827F62A08BD691EE20EF25F4443EEA371FB84794F984231E69D07AA9DF7CD581C710

Function 00007FF759154200 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

prefs.js, xrefs: 00007FF759155762
directory_iterator::directory_iterator, xrefs: 00007FF759154FA3, 00007FF759156624
exists, xrefs: 00007FF75915660D
cannot use push_back() with , xrefs: 00007FF759154F55
status, xrefs: 00007FF759154F91, 00007FF759154FB3, 00007FF759154FDB, 00007FF759155003

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 4ddf6a19af2319216cee83245caa5fa330ade87ad66d8756843333efb6e909ff
Instruction ID: 598654a1b491a771ea6329142958b79db5fb48db620659b034665e871dfd7cf3
Opcode Fuzzy Hash: 4ddf6a19af2319216cee83245caa5fa330ade87ad66d8756843333efb6e909ff
Instruction Fuzzy Hash: 78522932509BC595EA71AF19F8813EAF3A4FB89780F545225DACC43B59EF38D194CB10

Function 00007FF7591DB5E0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FF7591DB68D
GetLastError.KERNEL32 ref: 00007FF7591DB697
FindFirstFileW.KERNEL32 ref: 00007FF7591DB6AE
GetLastError.KERNEL32 ref: 00007FF7591DB6BA
FindClose.KERNEL32 ref: 00007FF7591DB6C8
__std_fs_open_handle.LIBCPMT ref: 00007FF7591DB75B
CloseHandle.KERNEL32 ref: 00007FF7591DB771
CloseHandle.KERNEL32 ref: 00007FF7591DB8E4

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 85049687b5dde28f65619eec6ecb9dcc7cc2f377e42605e75442889216d79f68
Instruction ID: 474d934389ecca90989a082e72f737e3436becbe0174a347f5615bdc17f5dc5d
Opcode Fuzzy Hash: 85049687b5dde28f65619eec6ecb9dcc7cc2f377e42605e75442889216d79f68
Instruction Fuzzy Hash: 8C917E31A48B5246FFA4AF25B500679A2B5AF84BB4F9C0335EA7E476D4DF2CE5018720

Function 00007FF759124A50 Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 369
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF759124DD2

Strings

directory_iterator::directory_iterator, xrefs: 00007FF759124A14, 00007FF75912578D
exists, xrefs: 00007FF7591249F2, 00007FF75912576E
status, xrefs: 00007FF7591257A9

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Open
String ID: directory_iterator::directory_iterator$exists$status
API String ID: 71445658-3429586796
Opcode ID: e5264a72e81408a58a012c8a1cbb6d37a5e9ce24cbcada9c2242042ab7c6cb9c
Instruction ID: a34d4cc4626ef0839bcecf3032fa7fe5e6db020fdad80ad28903294a22c94cfd
Opcode Fuzzy Hash: e5264a72e81408a58a012c8a1cbb6d37a5e9ce24cbcada9c2242042ab7c6cb9c
Instruction Fuzzy Hash: 55122832905BC48AEB719F39EC803E973A4F749798F555325EA9C1BB99EF749290C300

Function 00007FF75912D6E0 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 671
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CredEnumerateA.ADVAPI32 ref: 00007FF75912D742
CredFree.ADVAPI32 ref: 00007FF75912E166
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912E19C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912E1F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912E1F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912E1FC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912E202
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912E208
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912E20E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912E214
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912E21A

Strings

cannot use push_back() with , xrefs: 00007FF75912E1B4

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 1347986415-4122110429
Opcode ID: fbcc9960ac331cd7b5ad62ef94e6243cf707cdddad4eaf96dd9412e6c6daf901
Instruction ID: ee822a06c72400f72046d8f426ed4a55cfd6ac9b86995ce6b6a4aad85e3d632c
Opcode Fuzzy Hash: fbcc9960ac331cd7b5ad62ef94e6243cf707cdddad4eaf96dd9412e6c6daf901
Instruction Fuzzy Hash: D4628272A08BD589EB209F25E8403EDB771F749798F944225EAAC17B99DF38D284C710

Function 00007FF75917C9C0 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF75917CB74
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF75917CB82
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF75917CE05
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF75917CE13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917CFB0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917CFB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917CFD9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917CFDF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917CFE5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917D008
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917D00E

Strings

value, xrefs: 00007FF75917CA9A, 00007FF75917CD33

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: 1619d6d474f31fb53aedb52b761491993b205f07f8ed022c08ddbe75d6a52ee1
Instruction ID: dac61b1878a1eadfccb32571bdbfcc87b56a5ef267b87aa081548490992e9117
Opcode Fuzzy Hash: 1619d6d474f31fb53aedb52b761491993b205f07f8ed022c08ddbe75d6a52ee1
Instruction Fuzzy Hash: 75028222A18BD185EF00EF74E4402ADA771EB857A4F985231FAAD03BDADF2CD585C750

Function 00007FF7591696D0 Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 413
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75916CDE0: GetCurrentProcess.KERNEL32 ref: 00007FF75916CE1B
Part of subcall function 00007FF75916CDE0: OpenProcessToken.ADVAPI32 ref: 00007FF75916CE2E
Part of subcall function 00007FF75916CDE0: GetTokenInformation.KERNELBASE ref: 00007FF75916CE6A
Part of subcall function 00007FF75916CDE0: CloseHandle.KERNEL32 ref: 00007FF75916CE8B

ExitProcess.KERNEL32 ref: 00007FF759169728
OpenMutexA.KERNEL32 ref: 00007FF759169843
ExitProcess.KERNEL32 ref: 00007FF759169853

Part of subcall function 00007FF75916D120: GetModuleFileNameW.KERNEL32 ref: 00007FF75916D16A

Part of subcall function 00007FF7591786E0: CoInitializeEx.OLE32 ref: 00007FF75917874A

Strings

SeDebugPrivilege, xrefs: 00007FF75916972F
SeImpersonatePrivilege, xrefs: 00007FF75916973B

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Process$ExitOpenToken$CloseCurrentFileHandleInformationInitializeModuleMutexName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 3348294976-3768118664
Opcode ID: 199beb2f2dfcb68d3d562edd111b9bd2447c991b0721510d36a9b4e8f30c3d03
Instruction ID: be48257d5947eba3285dc33e1a808e5060e72757964bb025c95945794eb62934
Opcode Fuzzy Hash: 199beb2f2dfcb68d3d562edd111b9bd2447c991b0721510d36a9b4e8f30c3d03
Instruction Fuzzy Hash: 24122F21A1D996A1EE20FF61F4512E9E376FFD5380FC80532E18D469AADF2CE905C760

Function 00007FF759172890 Relevance: 16.9, APIs: 11, Instructions: 408
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 00007FF759172A5B
InternetOpenUrlA.WININET ref: 00007FF759172B38
HttpQueryInfoW.WININET ref: 00007FF759172B99
HttpQueryInfoW.WININET ref: 00007FF759172C32
InternetQueryDataAvailable.WININET ref: 00007FF759172C76
InternetReadFile.WININET ref: 00007FF759172D39
InternetQueryDataAvailable.WININET ref: 00007FF759172E04
InternetCloseHandle.WININET ref: 00007FF759172EAE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759172EFF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759172F05
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759172F0B

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen_invalid_parameter_noinfo_noreturn$CloseConcurrency::cancel_current_taskFileHandleRead
String ID:
API String ID: 1352168858-0
Opcode ID: ec3456ac992806f8490612d3919b847c0d567006da67147138721cadd16efd14
Instruction ID: 64f3a5490c4a9d612c31f1aa36bd528db90ad006e377ac5a607c7033bf049c7b
Opcode Fuzzy Hash: ec3456ac992806f8490612d3919b847c0d567006da67147138721cadd16efd14
Instruction Fuzzy Hash: DF02AE32A18B9186EB10DF69F8403AEB7B4FB89794F540625EE9C17B98DF38D481C710

Function 00007FF75912F2E0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 328
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF75912F32A
Process32FirstW.KERNEL32 ref: 00007FF75912F36C
Process32NextW.KERNEL32 ref: 00007FF75912F563
CloseHandle.KERNEL32 ref: 00007FF75912F7DA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F873
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F879
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F87F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912F885

Strings

[PID: , xrefs: 00007FF75912F3AE

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 1946380282-2210602247
Opcode ID: b3b1c53ecf6a850687b54bd6122f76093b8db61cd60b1428289ca85680724f14
Instruction ID: 0df47b4c27ac227f53fcd4f44cbe7eda6caee7a7b28c99e3a7ecb86a8509448c
Opcode Fuzzy Hash: b3b1c53ecf6a850687b54bd6122f76093b8db61cd60b1428289ca85680724f14
Instruction Fuzzy Hash: 6BE1B332A18BC585EB20EF25E4803EDB7B5F7897A4F944225EA9D07B99DF38D244C710

Function 00007FF75912F890 Relevance: 15.7, APIs: 10, Instructions: 715COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759130581
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759130587
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75913058D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759130593
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759130599
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75913059F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591305A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591305AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591305B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591305B7

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 8cf1e2e3a877cd24a2da459ec217a2ba60981e1f9362bf8b9eea48fa588f7ec2
Instruction ID: 72c5b787d876e3af6e0ef2fc72a28d0cf1dc21084796902b8332a480a4fe7c0d
Opcode Fuzzy Hash: 8cf1e2e3a877cd24a2da459ec217a2ba60981e1f9362bf8b9eea48fa588f7ec2
Instruction Fuzzy Hash: 72728F72A18BD989EB20DF69E8403ADB3B5F788798F544325EA9C17B99DF38D140C710

Function 00007FF75916C5E0 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 451fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00007FF75916C821
SetFilePointer.KERNEL32 ref: 00007FF75916C8D4
ReadFile.KERNEL32 ref: 00007FF75916C903
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916CD97

Strings

ios_base::eofbit set, xrefs: 00007FF75916CD44
exists, xrefs: 00007FF75916CD8A
ios_base::badbit set, xrefs: 00007FF75916CD31, 00007FF75916CDAF
ios_base::failbit set, xrefs: 00007FF75916CD3D

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: File$PointerReadSize_invalid_parameter_noinfo_noreturn
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2478245620-15404121
Opcode ID: d7d13687def4016a941bf1933e12be48d524e9cd5fcb599fca2ca1a1f8848f3a
Instruction ID: c633540733360c7bd870d331fbc4bda3bc0b7bb428f394aaa28165acf23e3630
Opcode Fuzzy Hash: d7d13687def4016a941bf1933e12be48d524e9cd5fcb599fca2ca1a1f8848f3a
Instruction Fuzzy Hash: C4322532A08BD589EB20DF24E8803ED77B1FB85748F988226DB4D47A99EF78D544C750

Function 00007FF75919A588 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF75919A5CD

Part of subcall function 00007FF759199C34: _invalid_parameter_noinfo.LIBCMT ref: 00007FF759199C48

Part of subcall function 00007FF7591947C0: RtlFreeHeap.NTDLL(?,?,FFFFFFFFF0B8480A,00007FF75919F1B2,?,?,?,00007FF75919F52F,?,?,00000000,00007FF75919D281,?,?,00007FF7591A366E,00007FF75919D1B3), ref: 00007FF7591947D6
Part of subcall function 00007FF7591947C0: GetLastError.KERNEL32(?,?,FFFFFFFFF0B8480A,00007FF75919F1B2,?,?,?,00007FF75919F52F,?,?,00000000,00007FF75919D281,?,?,00007FF7591A366E,00007FF75919D1B3), ref: 00007FF7591947E0

Part of subcall function 00007FF759183BF4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF759183BA3,?,?,?,?,?,00007FF759183A8E), ref: 00007FF759183BFD
Part of subcall function 00007FF759183BF4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF759183BA3,?,?,?,?,?,00007FF759183A8E), ref: 00007FF759183C22

Part of subcall function 00007FF7591A31D4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7591A311F

_get_daylight.LIBCMT ref: 00007FF75919A5BC

Part of subcall function 00007FF759199C94: _invalid_parameter_noinfo.LIBCMT ref: 00007FF759199CA8

_get_daylight.LIBCMT ref: 00007FF75919A832
_get_daylight.LIBCMT ref: 00007FF75919A843
_get_daylight.LIBCMT ref: 00007FF75919A854
GetTimeZoneInformation.KERNEL32(00007FF75919AB44), ref: 00007FF75919A87B

Strings

Eastern Standard Time, xrefs: 00007FF75919A921
Eastern Summer Time, xrefs: 00007FF75919A939

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 09ada61799f9e34989d6b846d1425fa5122a705a702ae65f731ec7cff66c12f5
Instruction ID: b1677a54eec19c37ad1f016b481e4d0aad4edce9a5dc9c56984861ca1858162b
Opcode Fuzzy Hash: 09ada61799f9e34989d6b846d1425fa5122a705a702ae65f731ec7cff66c12f5
Instruction Fuzzy Hash: BAD1AF26A0826286FF64BF25E8515B9A7B2FF84794FCC8135EA0D47685DF3CE446C360

Function 00007FF7591E2268 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7591E1E4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7591E1E8D
Part of subcall function 00007FF7591E1E4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7591E1F0B
Part of subcall function 00007FF7591E1E4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7591E1F5C

CreateFileW.KERNEL32 ref: 00007FF7591E236E
CreateFileW.KERNEL32 ref: 00007FF7591E23BE
GetLastError.KERNEL32 ref: 00007FF7591E23EE
GetFileType.KERNEL32 ref: 00007FF7591E2403
GetLastError.KERNEL32 ref: 00007FF7591E240D
CloseHandle.KERNEL32 ref: 00007FF7591E2440
CloseHandle.KERNEL32 ref: 00007FF7591E25A3
CreateFileW.KERNEL32 ref: 00007FF7591E25D8
GetLastError.KERNEL32 ref: 00007FF7591E25E7

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 88c67a62c97e9640d8f824194156037d4643487aa4b8d57f45b5f64436b2e6ec
Instruction ID: d77f577d21d7c63062e0e2ea86591d500158f140f199c8572f9950c4ffec21bc
Opcode Fuzzy Hash: 88c67a62c97e9640d8f824194156037d4643487aa4b8d57f45b5f64436b2e6ec
Instruction Fuzzy Hash: E3C1C332B14A5186EF50EF65D4902ACBB71F749B98B891639DF2E5B794CF38D051C310

Function 00007FF7591756A0 Relevance: 10.7, APIs: 4, Strings: 1, Instructions: 1985COMMON

Download Yara Rule

Strings

%d-%m-%Y, %H:%M:%S, xrefs: 00007FF759176BBB

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: CurrentProfile
String ID: %d-%m-%Y, %H:%M:%S
API String ID: 2104809126-3495478971
Opcode ID: 7ec3947b1576f89eb4bf083a6752bce0deca2ca537ef56e87aad6f50fee9c44c
Instruction ID: d11b854322a68236e4d677c0f880d0cb50406a3c18b441c5b69748a2a0ce7f17
Opcode Fuzzy Hash: 7ec3947b1576f89eb4bf083a6752bce0deca2ca537ef56e87aad6f50fee9c44c
Instruction Fuzzy Hash: 59239E33A18BD589EB20DF64E8402EDB7B5F789788F844225EA8D17B59EF38D640C750

Function 00007FF75919A804 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF75919A832

Part of subcall function 00007FF759199C94: _invalid_parameter_noinfo.LIBCMT ref: 00007FF759199CA8

_get_daylight.LIBCMT ref: 00007FF75919A843

Part of subcall function 00007FF759199C34: _invalid_parameter_noinfo.LIBCMT ref: 00007FF759199C48

_get_daylight.LIBCMT ref: 00007FF75919A854

Part of subcall function 00007FF759199C64: _invalid_parameter_noinfo.LIBCMT ref: 00007FF759199C78

Part of subcall function 00007FF7591947C0: RtlFreeHeap.NTDLL(?,?,FFFFFFFFF0B8480A,00007FF75919F1B2,?,?,?,00007FF75919F52F,?,?,00000000,00007FF75919D281,?,?,00007FF7591A366E,00007FF75919D1B3), ref: 00007FF7591947D6
Part of subcall function 00007FF7591947C0: GetLastError.KERNEL32(?,?,FFFFFFFFF0B8480A,00007FF75919F1B2,?,?,?,00007FF75919F52F,?,?,00000000,00007FF75919D281,?,?,00007FF7591A366E,00007FF75919D1B3), ref: 00007FF7591947E0

GetTimeZoneInformation.KERNEL32(00007FF75919AB44), ref: 00007FF75919A87B

Strings

Eastern Standard Time, xrefs: 00007FF75919A921
Eastern Summer Time, xrefs: 00007FF75919A939

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 1d54ad7d994230515202f367153890dc5f42ca7bd2fd500aa621977fc25ffad9
Instruction ID: ae16b6d7c94b8ccea083d496e08f9c0210033b5a7dff5a23036b05c8655e15b9
Opcode Fuzzy Hash: 1d54ad7d994230515202f367153890dc5f42ca7bd2fd500aa621977fc25ffad9
Instruction Fuzzy Hash: D0518D32A0866286FB50FF25E8815A9F7B2FB48784FCC4135EA4D47695DF3CE4428760

Function 00007FF759173EC0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 268COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591742AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591742B1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591742B7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591742BD

Strings

cores, xrefs: 00007FF75917411E

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: cores
API String ID: 3668304517-2370456839
Opcode ID: 0220d059ab561a04e2f7a07c1bbfb59cec5a6b68bb6c96023436828c929fb959
Instruction ID: ead905298f4cf6cb17cfba7b2f850b278fec0b3067b707ddc3fdc31e8d715c1e
Opcode Fuzzy Hash: 0220d059ab561a04e2f7a07c1bbfb59cec5a6b68bb6c96023436828c929fb959
Instruction Fuzzy Hash: 60C1E563E18B8186FB10DF78E4403ACB772E7993A8F545325EA9C12ADADF78D581C350

Function 00007FF759179910 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF75917995E
OpenProcessToken.ADVAPI32 ref: 00007FF759179971
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF759179992
AdjustTokenPrivileges.KERNELBASE ref: 00007FF7591799D8
CloseHandle.KERNEL32 ref: 00007FF7591799F8

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 8ce77bd8c96780d8ce51cbf27ba3336efb55788d0aa1b2300ace07bcdbe83e4b
Instruction ID: 80284571803a89c78b0392294011813326b921b987ba151500a1a7649621aa88
Opcode Fuzzy Hash: 8ce77bd8c96780d8ce51cbf27ba3336efb55788d0aa1b2300ace07bcdbe83e4b
Instruction Fuzzy Hash: 9C214C32618B8182F7509F12F44436AF3B1FB88B90F998135EA8E47B58DF7CD9458B50

Function 00007FF7591BDBC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 431COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7591DD110: GetCurrentThreadId.KERNEL32 ref: 00007FF7591DD161
Part of subcall function 00007FF7591DD110: AcquireSRWLockExclusive.KERNEL32 ref: 00007FF7591DD180

std::_Throw_Cpp_error.LIBCPMT ref: 00007FF7591BDED7
std::_Throw_Cpp_error.LIBCPMT ref: 00007FF7591BDEE2
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF7591DD12A

Strings

PLH, xrefs: 00007FF7591BE086

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Cpp_errorExclusiveLockThrow_std::_$AcquireCurrentReleaseThread
String ID: PLH
API String ID: 3715443949-3073785353
Opcode ID: 194f42d5ca84793d6f8092bc43aa08e6ddaec95eeb91ffeb0a26ce8f79bc2a51
Instruction ID: 4cddfbd99d580831c9d06ca4de169a5cce40b5513586e91414110f4f603dcde4
Opcode Fuzzy Hash: 194f42d5ca84793d6f8092bc43aa08e6ddaec95eeb91ffeb0a26ce8f79bc2a51
Instruction Fuzzy Hash: 4402E0B6A09BA082EF68AF15E550128B3B6FB48BD0B9D8031DB9D47794DF3CD891C750

Function 00007FF759121B70 Relevance: 4.8, APIs: 3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be52d5859a54412bc85759e63806bac1250deae1596b2059aa4a3538819d764e
Instruction ID: f3bfb038cddece3a010ecba3412c14d454e816fae75315ef33c813d98397f083
Opcode Fuzzy Hash: be52d5859a54412bc85759e63806bac1250deae1596b2059aa4a3538819d764e
Instruction Fuzzy Hash: F1F16172A09B8889EB209F69E44039DB7B4F788798F544325EEDC56B99EF7CD190C700

Function 00007FF759122260 Relevance: 4.8, APIs: 3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b8316ca7f89444fccc97d15d47cd3c975deaabdac9190525369719b579a9fa
Instruction ID: 9bea1e464ef269320abd1871b1378383e5b09522cf0c898bf1af89264bff0eac
Opcode Fuzzy Hash: b7b8316ca7f89444fccc97d15d47cd3c975deaabdac9190525369719b579a9fa
Instruction Fuzzy Hash: 1FF14172A08B848AEB209F69E44039DB7B5F788798F544325EEDC57B99EF7CD1908700

Function 00007FF7591699C3 Relevance: 3.3, APIs: 2, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF75912F2E0: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF75912F32A
Part of subcall function 00007FF75912F2E0: Process32FirstW.KERNEL32 ref: 00007FF75912F36C

Part of subcall function 00007FF75912D6E0: CredEnumerateA.ADVAPI32 ref: 00007FF75912D742

Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44A9
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44AF
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44B5
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44BB
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44C1
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44C7
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44CD
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44D3
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44D9

Part of subcall function 00007FF75918AC90: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF75918ACA4

ReleaseMutex.KERNEL32 ref: 00007FF759169DBF
CloseHandle.KERNEL32 ref: 00007FF759169DC8

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Time$CloseCreateCredEnumerateFileFirstHandleMutexProcess32ReleaseSnapshotSystemToolhelp32
String ID:
API String ID: 2954792532-0
Opcode ID: 7895ce43db69ecbcdfcd3645df6b442c92a242c4517328c9574893a3d5b3afe6
Instruction ID: 6889602a55a93f3dd38ea9137617e576527cfb3ed2bf6fbc6d4538011dbe67c1
Opcode Fuzzy Hash: 7895ce43db69ecbcdfcd3645df6b442c92a242c4517328c9574893a3d5b3afe6
Instruction Fuzzy Hash: 31C1BC21A19996A1EE20FF61F4512F9D376FFD1340FC85432E18E469AA9F2CEA05C760

Function 00007FF759164DB0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FF759164E08
LocalFree.KERNEL32 ref: 00007FF759164E9A

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 5b4fbf053442e25310b53dca1c7b2668b3ec911186700120499bd6f4c1eedf9a
Instruction ID: 21f6e6b1607e1614c98513ccc9bbd3937ea2a830811d682cd03dad412ce4b255
Opcode Fuzzy Hash: 5b4fbf053442e25310b53dca1c7b2668b3ec911186700120499bd6f4c1eedf9a
Instruction Fuzzy Hash: 54414832A18B90CAE7209F74E4403AD77A4F75878CF485239EA8D06E8ADF79D564C354

Function 00007FF759174A60 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 00007FF759174AD1

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: f6ef34cfcb41f3052617f1b5c8a5d3e54f7dd10a2ea138f4be8893bf6e9d4fff
Instruction ID: 334318495c24559df7e5d50f486261236b61dbbecda4ae71167b7ebf0309b03e
Opcode Fuzzy Hash: f6ef34cfcb41f3052617f1b5c8a5d3e54f7dd10a2ea138f4be8893bf6e9d4fff
Instruction Fuzzy Hash: FE41B232A18B8182E710DF20E4803AEB775FB94788F545225EA8C23A69DF7CE5D1D740

Function 00007FF7591737A0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF7591737E5

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 0c2110f803cbe5af6d23293a590b4dbbdb5d8d4f5a89538c0093553484e9bea2
Instruction ID: 2b2611feeccd68896b79225270c12ccc325d64e3335fd8b9aad0803dfefe1a06
Opcode Fuzzy Hash: 0c2110f803cbe5af6d23293a590b4dbbdb5d8d4f5a89538c0093553484e9bea2
Instruction Fuzzy Hash: 3E01883251C78282EB60DF11F4413A9F3B4FB98788F845135E68D42649DFBCD595CB40

Function 00007FF7591CC4B0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF7591CCE94,00000001,?,?,00007FF7591CCC81), ref: 00007FF7591CC4C4

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6d2310d077955d8aea653d85a9e0a070073bd4ce5a7b7d11e752ffe5c3d7ecfc
Instruction ID: 06febc702d849e5b6ea1320429f35a60b1b51d989848716a08c9b4257832d8bc
Opcode Fuzzy Hash: 6d2310d077955d8aea653d85a9e0a070073bd4ce5a7b7d11e752ffe5c3d7ecfc
Instruction Fuzzy Hash: 93F0EC31B187468BEB88DB1DA855229B7E5F789700F844139EA4EC3794DF7CE8128B50

Function 00007FF759135430 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF7591354B9

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: 8703bcf897a27782d48fff385ec9f2f5ba8ce20dd7dcf58d6ef2ee578fa5f6dc
Instruction ID: 936ec41a11ccd62231b3358932f29d9038d38509acde13d1f518ad5d18c218ae
Opcode Fuzzy Hash: 8703bcf897a27782d48fff385ec9f2f5ba8ce20dd7dcf58d6ef2ee578fa5f6dc
Instruction Fuzzy Hash: 8A41F56361D6E44ADB02CF39901127DBFB2D366F89B5CC162DBD887746DA2DD206CB20

Function 00007FF75916D260 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 250
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF759172F20: GetUserGeoID.KERNEL32 ref: 00007FF759172F47
Part of subcall function 00007FF759172F20: GetGeoInfoA.KERNEL32 ref: 00007FF759172F61
Part of subcall function 00007FF759172F20: GetGeoInfoA.KERNEL32 ref: 00007FF759172FB1

WSAStartup.WS2_32 ref: 00007FF75916D3D9
socket.WS2_32 ref: 00007FF75916D3FA
htons.WS2_32 ref: 00007FF75916D420
inet_pton.WS2_32 ref: 00007FF75916D463
connect.WS2_32 ref: 00007FF75916D47D
closesocket.WS2_32 ref: 00007FF75916D49C
WSACleanup.WS2_32 ref: 00007FF75916D4A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916D649
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916D64F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916D655

Strings

><>, xrefs: 00007FF75916D459
system, xrefs: 00007FF75916D345
geo, xrefs: 00007FF75916D386

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: ><>$geo$system
API String ID: 2440148987-2232953017
Opcode ID: d4dff7520a3afc50201f499a3a0ed83a1c9e52c987558fa1ea5baea3b14e913a
Instruction ID: afba9c7b0547bf5f5520058ad97e89564cbac9355d904cbbb47517f0497a4384
Opcode Fuzzy Hash: d4dff7520a3afc50201f499a3a0ed83a1c9e52c987558fa1ea5baea3b14e913a
Instruction Fuzzy Hash: 1CC19362F09B9295FB00EF64E4402ACB372EB44798F895236DA5C1BAD9DF7CE546C310

Function 00007FF75916C1B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF75916BF30: InitializeCriticalSectionEx.KERNEL32 ref: 00007FF75916BF81
Part of subcall function 00007FF75916BF30: GetLastError.KERNEL32 ref: 00007FF75916BF8B

EnterCriticalSection.KERNEL32 ref: 00007FF75916C1F1
GdiplusStartup.GDIPLUS ref: 00007FF75916C218
LeaveCriticalSection.KERNEL32 ref: 00007FF75916C226
LeaveCriticalSection.KERNEL32 ref: 00007FF75916C254
GdipGetImageEncodersSize.GDIPLUS ref: 00007FF75916C262
GdipGetImageEncoders.GDIPLUS ref: 00007FF75916C2F6
GdipCreateBitmapFromScan0.GDIPLUS ref: 00007FF75916C3C0
GdipSaveImageToStream.GDIPLUS ref: 00007FF75916C3DE
GdipDisposeImage.GDIPLUS ref: 00007FF75916C443
GdipDisposeImage.GDIPLUS ref: 00007FF75916C457

Strings

&, xrefs: 00007FF75916C3BA

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: ee4d62d479441ac8687bbf56f85e9b5e7d012d309e883670cf16dba04190e65e
Instruction ID: a60f1cc36c6eb1e6f19c0ae99dfa16a59f83b45dd982705402c657d48a121b6e
Opcode Fuzzy Hash: ee4d62d479441ac8687bbf56f85e9b5e7d012d309e883670cf16dba04190e65e
Instruction Fuzzy Hash: E191A232A04B9289EB10EF61E8405B8B7B4FB58798F898136DA4D47B94DF3CE585C390

Function 00007FF759177AD0 Relevance: 13.6, APIs: 9, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF759177B01
GetProcessId.KERNEL32 ref: 00007FF759177B0A
RmStartSession.RSTRTMGR ref: 00007FF759177B2A
RmRegisterResources.RSTRTMGR ref: 00007FF759177B55
RmGetList.RSTRTMGR ref: 00007FF759177B8E
RmGetList.RSTRTMGR ref: 00007FF759177BF0
RmEndSession.RSTRTMGR ref: 00007FF759177C2B
RmEndSession.RSTRTMGR ref: 00007FF759177C62
RmEndSession.RSTRTMGR ref: 00007FF759177C77

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Session$ListProcess$CurrentRegisterResourcesStart
String ID:
API String ID: 3299295986-0
Opcode ID: ac7f17f62b0b4b4372e261901ae0ae280e2f32aacd8c1b6a651c7a63f9ba0fb0
Instruction ID: f7030cc40a10260e1eb6d4b0884bc5b1dcf04878d253c8edbcf2b4db34346f86
Opcode Fuzzy Hash: ac7f17f62b0b4b4372e261901ae0ae280e2f32aacd8c1b6a651c7a63f9ba0fb0
Instruction Fuzzy Hash: 7A515032B08A528AFB54DFA0E4545ADB3B1FB48748F98453ADE0D67B94DF38E806C750

Function 00007FF759123A40 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 220COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759123AA3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759123D8E

Strings

directory_iterator::directory_iterator, xrefs: 00007FF759124A14, 00007FF75912578D, 00007FF75912712B
content, xrefs: 00007FF7591246C5, 00007FF759125444, 00007FF7591262A2, 00007FF7591268F0, 00007FF759126E0F
exists, xrefs: 00007FF7591249F2, 00007FF75912576E, 00007FF75912707C, 00007FF7591270C7, 00007FF759127164
filename, xrefs: 00007FF759124537, 00007FF7591252B0, 00007FF759126193, 00007FF759126727, 00007FF759126C49
status, xrefs: 00007FF7591257A9, 00007FF7591270ED, 00007FF7591270FD

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3668304517-3429737954
Opcode ID: abf46c4bcc37c826b541a3eec46f1496ce407cd581ecc481a2a2dbd3f5772e1c
Instruction ID: 3c8b188fe0230c81f37b398766d85e5fdd79e9075a04270d585d785e5df206e4
Opcode Fuzzy Hash: abf46c4bcc37c826b541a3eec46f1496ce407cd581ecc481a2a2dbd3f5772e1c
Instruction Fuzzy Hash: ADA1BF62F08B95C9FF01EF75E0403EC63B1EB49B48F885225EA5D22A99EF39D190C354

Function 00007FF7591B83D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF7591B8407
LoadLibraryA.KERNEL32 ref: 00007FF7591B845F
GetProcAddress.KERNEL32 ref: 00007FF7591B8474
GetCurrentProcess.KERNEL32 ref: 00007FF7591B847D
VirtualAlloc2.KERNELBASE ref: 00007FF7591B84AB

Strings

VirtualAlloc2, xrefs: 00007FF7591B846A
kernelbase.dll, xrefs: 00007FF7591B8449

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: AddressAlloc2CurrentInfoLibraryLoadProcProcessSystemVirtual
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 3240720159-1188699709
Opcode ID: 938162ec5529eeba8205653a98cfbd1f6f15b8febfdf609c6d8605836a059b36
Instruction ID: 1f4598d8485df47e9739b45134a2f02f07efe5b2bb2fd12610a1e9d840266f64
Opcode Fuzzy Hash: 938162ec5529eeba8205653a98cfbd1f6f15b8febfdf609c6d8605836a059b36
Instruction Fuzzy Hash: B4212736A09B8182EB10CF11F444369B7B0FB88B90F98422AEB8D03B64DF7CD595CB00

Function 00007FF759196860 Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF759196C8D

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5f0b478f29d8ffc612cbfcf804fef0a23c1ee2bddfe9812612c20999c88c8e7a
Instruction ID: b3789d1f4da12e3fc25af97de22420da8d990a610daa399c136671f741f1cd3e
Opcode Fuzzy Hash: 5f0b478f29d8ffc612cbfcf804fef0a23c1ee2bddfe9812612c20999c88c8e7a
Instruction Fuzzy Hash: 03C1A122A08B9681EE607F15A4402BDFAB2FB81BC0F9D4131EA5E03795DF7DE8558371

Function 00007FF75916DD50 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 371networkCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916E35D
send.WS2_32 ref: 00007FF75916E488

Strings

ios_base::badbit set, xrefs: 00007FF75916E395, 00007FF75916E3CC, 00007FF75916E40A
exists, xrefs: 00007FF75916E373

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnsend
String ID: exists$ios_base::badbit set
API String ID: 1659112300-2074760687
Opcode ID: 6c36c8f859000d88029b81b96894c101117fa5a7005d8a2cf2a454c639a71651
Instruction ID: c2ddb73951755757f46f328b022c47f01babeed6cb6b374ef87803d07f5ea570
Opcode Fuzzy Hash: 6c36c8f859000d88029b81b96894c101117fa5a7005d8a2cf2a454c639a71651
Instruction Fuzzy Hash: 9D024E72A196D291EE60EF14F4843EAE370FB85784F844232DA8D53AA9DF3CD545CB50

Function 00007FF75916C010 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF75916C053
EnterCriticalSection.KERNEL32 ref: 00007FF75916C065
EnterCriticalSection.KERNEL32 ref: 00007FF75916C075
GdiplusShutdown.GDIPLUS ref: 00007FF75916C083
LeaveCriticalSection.KERNEL32 ref: 00007FF75916C090
LeaveCriticalSection.KERNEL32 ref: 00007FF75916C09A

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 553be29db5892d5f49380c82de3d8774b7a2741da7bcb8a2912f674bad50868d
Instruction ID: e996ba33fe0dec067fe383f2974bcf88f7f9c928fccd305e3fadbd526c660231
Opcode Fuzzy Hash: 553be29db5892d5f49380c82de3d8774b7a2741da7bcb8a2912f674bad50868d
Instruction Fuzzy Hash: 1A113D32916B5181EB50AF65E850029B378FB48F64B984236D65D076A4CF38D997C750

Function 00007FF75916E236 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 136networkCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916E357
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916E35D

Part of subcall function 00007FF7591A85D8: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,-728320C5349B87FA,00007FF7591DC402), ref: 00007FF7591A8628
Part of subcall function 00007FF7591A85D8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,-728320C5349B87FA,00007FF7591DC402), ref: 00007FF7591A8669

send.WS2_32 ref: 00007FF75916E488

Strings

ios_base::badbit set, xrefs: 00007FF75916E395, 00007FF75916E3CC, 00007FF75916E40A
exists, xrefs: 00007FF75916E373

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ExceptionFileHeaderRaisesend
String ID: exists$ios_base::badbit set
API String ID: 2551022557-2074760687
Opcode ID: c2ed9d43995441ba27536c602e0a3a90baa6752a13320ebdcca74d58982504d5
Instruction ID: f00c993c028051417984177bb8d350ad2d06aeb396128e061ab25bf8e55cb40f
Opcode Fuzzy Hash: c2ed9d43995441ba27536c602e0a3a90baa6752a13320ebdcca74d58982504d5
Instruction Fuzzy Hash: 07513E72A19AC291EE20EF15F4842EAF3B1FB84794F885132DA4D43B99DF2CD545CB50

Function 00007FF759174740 Relevance: 7.6, APIs: 5, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF7591747C9
RegEnumKeyExA.KERNEL32 ref: 00007FF75917480A

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: 1e9b86084d8bdee174a8be27c829b56ee5a173848a60e4e3bac61f26fc4f4335
Instruction ID: 2d851a6fc9321d36248d82b56162b711cd6122f5302f963970570fc43f7d0d8c
Opcode Fuzzy Hash: 1e9b86084d8bdee174a8be27c829b56ee5a173848a60e4e3bac61f26fc4f4335
Instruction Fuzzy Hash: 22419136A04B9286FB10AF61F8402AEB375FB4479CF641225EE5C13A94CF7CD596D700

Function 00007FF7591ABFA0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7591ABFC3
ReadProcessMemory.KERNEL32 ref: 00007FF7591ABFEC
GetLastError.KERNEL32 ref: 00007FF7591AC000
VirtualQueryEx.KERNEL32 ref: 00007FF7591AC01E
ReadProcessMemory.KERNEL32 ref: 00007FF7591AC04D

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Process$MemoryRead$CurrentErrorLastQueryVirtual
String ID:
API String ID: 2584129402-0
Opcode ID: 79c4906e68a013e8855fbbcd168ab546a4d40a596eb9804f0652fb9c821ebf06
Instruction ID: 3c255a24dee30dae498c9bcc9c82101993eb29d44ba4cb6324b68e2d61f9a868
Opcode Fuzzy Hash: 79c4906e68a013e8855fbbcd168ab546a4d40a596eb9804f0652fb9c821ebf06
Instruction Fuzzy Hash: E6214F25A08B9582EE60AF22E90476AE3B8FB55FC0F8C4032DE5D47B55CF3CE9458794

Function 00007FF75916D660 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 333COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916DC6D

Strings

ios_base::badbit set, xrefs: 00007FF75916DCA5, 00007FF75916DCDC, 00007FF75916DD1A
exists, xrefs: 00007FF75916DC83

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists$ios_base::badbit set
API String ID: 3668304517-2074760687
Opcode ID: 41b82dd2b689f8583e17054bfdf6b135f84e963cbfde7bcdaff525c02ecf0b66
Instruction ID: 2e28f93776d4768c03abc2b0d58a74bd7b61ef710d2b9d463e15b8cb3c3e0dad
Opcode Fuzzy Hash: 41b82dd2b689f8583e17054bfdf6b135f84e963cbfde7bcdaff525c02ecf0b66
Instruction Fuzzy Hash: 2AF12872A1DAD691EE60EF14F4843EAA371FB85784F844232DA8D42AA9DF3CD505CB50

Function 00007FF7591B07D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 199COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B0AE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B0AE7

Strings

-> , xrefs: 00007FF7591B0A1A
]: , xrefs: 00007FF7591B08ED

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: -> $]:
API String ID: 3668304517-2558318465
Opcode ID: 644e26a75d1a01a509a3dc31230f03793f7bae3800d2eec28f08da11f10119bf
Instruction ID: 34de1a21e3ccb0780c29263ed09a0dbd693caee96a06bb048823b5dd6575ad08
Opcode Fuzzy Hash: 644e26a75d1a01a509a3dc31230f03793f7bae3800d2eec28f08da11f10119bf
Instruction Fuzzy Hash: F191B272614B9585EF10EF39E4903ADB772EB85B94F889132EA0E077A9CF38D441C390

Function 00007FF75916A6D0 Relevance: 6.3, APIs: 4, Instructions: 284COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75916A862
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916A86E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916AB18
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916AB1E

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: cd467df561d73d2d9cd7e4891e485177b125e069401d81a8920392dce6881d70
Instruction ID: 55dbad8c67293cd7afb90d655fba606568833b82bae34b11de69e1581cda70a8
Opcode Fuzzy Hash: cd467df561d73d2d9cd7e4891e485177b125e069401d81a8920392dce6881d70
Instruction Fuzzy Hash: EFB19262A18B9585EF10AF25E4403ADA375FB847A4F984231EAAC07BD9DF3CD545C710

Function 00007FF759137F00 Relevance: 6.2, APIs: 4, Instructions: 192COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759138040
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759138046
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75913813F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759138145

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 9d1a35e1284dd0ede8f9f2931e4e084eecdb9e54a8de56f8ee8e1b43c527c036
Instruction ID: 26a8ecb0fafd6e43d883f88bf4ed7a190803f1aa11d5782dcfb033108302e971
Opcode Fuzzy Hash: 9d1a35e1284dd0ede8f9f2931e4e084eecdb9e54a8de56f8ee8e1b43c527c036
Instruction Fuzzy Hash: B251A362B09B6A95FE25BF11B5003B9E275AB04BE4F9C0631DA6D077D5DF3CE5828310

Function 00007FF75916CDE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF75916CE1B
OpenProcessToken.ADVAPI32 ref: 00007FF75916CE2E
GetTokenInformation.KERNELBASE ref: 00007FF75916CE6A
CloseHandle.KERNEL32 ref: 00007FF75916CE8B

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 0133e95664c9947a1615fea2e98d0114d1399641e70fc236894421ad937b8905
Instruction ID: 6e982244075e3ef64b1d541c9f1166c5262264f64f2511f96aadc14fcaae69f5
Opcode Fuzzy Hash: 0133e95664c9947a1615fea2e98d0114d1399641e70fc236894421ad937b8905
Instruction Fuzzy Hash: 5C112C32A19B8182EB50AF11F44031AB6B5FB88B80F995136EB8D47B68CF3CD415CB50

Function 00007FF759131CE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759131ECC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759131ED2

Strings

, xrefs: 00007FF759131D63

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-3916222277
Opcode ID: 7cdde82261053f353be9a4dea2225443be9669019ebd1b596cf1781a00150bc6
Instruction ID: 4a5fe8e73e8a69af68307b19b0b7a40f9d588dc2cecacf823ed32ffabf284515
Opcode Fuzzy Hash: 7cdde82261053f353be9a4dea2225443be9669019ebd1b596cf1781a00150bc6
Instruction Fuzzy Hash: A5515C72B08B5996EF159F2AE25426CB3B0FB48B94F984531DB5D43BA0CF39E461C310

Function 00007FF7591B96C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591B97EE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B97F4

Strings

nop, xrefs: 00007FF7591B9D14

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: nop
API String ID: 73155330-258488684
Opcode ID: 963a0ee2195fdb65848c24764c6cbeae62cb47b9b1e34926af7401fb864fe669
Instruction ID: ce1ef5dae87d58e751d29f723ccc4334a09bbd7616cb46b3281b5e223d65c6c9
Opcode Fuzzy Hash: 963a0ee2195fdb65848c24764c6cbeae62cb47b9b1e34926af7401fb864fe669
Instruction Fuzzy Hash: D6318122B0979551EE10EF15F04427DA2B6EB44BE8F980631DA6E07BC9DF3CE8528750

Function 00007FF759173AC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNEL32 ref: 00007FF759173B29

Strings

ProductName, xrefs: 00007FF759173B14
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF759173B1B

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: 10f3d5730bacd1f619464e985ebce9310f6794da947c255d442cd5462389d98d
Instruction ID: b0c766e4be84dc7334ed8b4c74f61548f79fb3e7a90c333d2a63895bf9b556a3
Opcode Fuzzy Hash: 10f3d5730bacd1f619464e985ebce9310f6794da947c255d442cd5462389d98d
Instruction Fuzzy Hash: 86116A32608B8182EB209F21F4403AAF3B4FB99788F944226EA8C07B59CF7CD555CB50

Function 00007FF7591209E0 Relevance: 4.7, APIs: 3, Instructions: 175COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 00007FF759120B13

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: d4662e6dd28ab28fd1f8b0485095b868be17f9ef920e149e56f9fc8bc94bc2f5
Instruction ID: 98a6644d8a69c9f913819196f3d4d4b3561c97b5cedb6542e2d507e4cd6651e0
Opcode Fuzzy Hash: d4662e6dd28ab28fd1f8b0485095b868be17f9ef920e149e56f9fc8bc94bc2f5
Instruction Fuzzy Hash: 8361A362F18652C5FF20BF76E4802ECA3B1AB44798F884631EE2E576D5DF79D8818250

Function 00007FF75916C490 Relevance: 4.6, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 00007FF75916C4E9
CoTaskMemFree.OLE32 ref: 00007FF75916C5AA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916C5D2

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: FolderFreeKnownPathTask_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2444108017-0
Opcode ID: 03c1d143ae1f016aa85a2c83c3734ac7a5810ffa36d58497f4a98336168588a3
Instruction ID: 82b2e410955d0878e8ff2d154745244d3c6656767dd36942cb5a2a61a33a0a3d
Opcode Fuzzy Hash: 03c1d143ae1f016aa85a2c83c3734ac7a5810ffa36d58497f4a98336168588a3
Instruction Fuzzy Hash: F2317572E18B8181EA209F25F44026AF771FB997A4F945325FAAC03AD5DF7CD581CB40

Function 00007FF759172F20 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 00007FF759172F47
GetGeoInfoA.KERNEL32 ref: 00007FF759172F61
GetGeoInfoA.KERNEL32 ref: 00007FF759172FB1

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: b00e7e739e986762500807f8f5e04299a991fb73d47a4efbdb72625afb2443ee
Instruction ID: 75afe0a642bed5fa44641b08d4c562c382f1a7bbabf538728a2a00a023d56249
Opcode Fuzzy Hash: b00e7e739e986762500807f8f5e04299a991fb73d47a4efbdb72625afb2443ee
Instruction Fuzzy Hash: 3411D032A18B8586EB10AF62F41071EB3B1FB84B84F485235EF8907B19CF3CE5908B44

Function 00007FF7591742D0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 00007FF75917430C

Strings

Unknown, xrefs: 00007FF7591743C6

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 5e6e3afab545b3bfb6ad890ca1e444ec1680c64d6d1187e3566ecc81084f52ea
Instruction ID: 4674f1b9495f5a8c7fd2c6b513c3c672b12fbda8a336a65735bca1c7b32a7db0
Opcode Fuzzy Hash: 5e6e3afab545b3bfb6ad890ca1e444ec1680c64d6d1187e3566ecc81084f52ea
Instruction Fuzzy Hash: DB31B223A2CBC186EB10DF20F5402AAA370FB99744F986225EBCD02A46DF7CD595CB10

Function 00007FF75917A0B0 Relevance: 3.3, APIs: 2, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739ae1418abeaeb35aef610425928764e44f1806fdf98d0e20ae2ed4f97bcd2f
Instruction ID: b3af42ca7783378333c8d0aa7968a3ea8be3333162ab7adbeff9694ac94fcd64
Opcode Fuzzy Hash: 739ae1418abeaeb35aef610425928764e44f1806fdf98d0e20ae2ed4f97bcd2f
Instruction Fuzzy Hash: D1D18E72A08B9585EB10EF25E4403ADB7B0FB89B98F988135EA4D07795DF3CD981C750

Function 00007FF7591AFDF0 Relevance: 3.2, APIs: 2, Instructions: 221COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591AFF99
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B0092

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 1b30117412136fdea639b524018df9740aa17bb1bcdf76a322087179e852827a
Instruction ID: e0b3650406c67659f5ab40a59ac9851e055dc26bd599a879588dabe0ceaeb05a
Opcode Fuzzy Hash: 1b30117412136fdea639b524018df9740aa17bb1bcdf76a322087179e852827a
Instruction Fuzzy Hash: 29919E22604A9585EF14AF39E0543ACB372EB45FE8F988131DA5D07B9ADF3CD8858390

Function 00007FF7591812A0 Relevance: 3.2, APIs: 2, Instructions: 189COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591814E4
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591814F0

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: fd5a8501b7403251c438327642f0845c95d6bfc7be1a6731c41452bd74eeb8af
Instruction ID: 51bfb5de325cc0a44e02260bb76b35a632be22a21acb5004357d079656e6fd19
Opcode Fuzzy Hash: fd5a8501b7403251c438327642f0845c95d6bfc7be1a6731c41452bd74eeb8af
Instruction Fuzzy Hash: 3B619B63B08A6184FE15AE15E24427CE3B1AB01F98F984531DE2D077D5DF3CD846E321

Function 00007FF75913CA21 Relevance: 3.2, APIs: 2, Instructions: 173COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75913CB48
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75913CB54

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 02357016d991b0669041614c2d6bbfd984dfc9099769fb7f6b763608a691d25f
Instruction ID: 8cb720d23ee7b8bb03cddbd2e1d96a47917df09a2a89c96503f1482482714067
Opcode Fuzzy Hash: 02357016d991b0669041614c2d6bbfd984dfc9099769fb7f6b763608a691d25f
Instruction Fuzzy Hash: 3351B062708BA981ED10EF16B40417AE674FB44BE4FA88A35DEAD177D5DF3CE0928310

Function 00007FF759169B7D Relevance: 3.2, APIs: 2, Instructions: 173synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44A9
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44AF
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44B5
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44BB
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44C1
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44C7
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44CD
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44D3
Part of subcall function 00007FF7591B3180: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B44D9

Part of subcall function 00007FF75918AC90: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF75918ACA4

ReleaseMutex.KERNEL32 ref: 00007FF759169DBF
CloseHandle.KERNEL32 ref: 00007FF759169DC8

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Time$CloseFileHandleMutexReleaseSystem
String ID:
API String ID: 1720901652-0
Opcode ID: 34dfd2351be6bedefa9dcd40e7fa1164d23ea18b5c10a7cff022a9e981694011
Instruction ID: f8a8fe7931e827c2d48af5dbc7882319d4f221f9fa12e4518814bc7bb0ff8d1c
Opcode Fuzzy Hash: 34dfd2351be6bedefa9dcd40e7fa1164d23ea18b5c10a7cff022a9e981694011
Instruction Fuzzy Hash: 3081EF21A1D996A1EE20FF61F4512FAD336FFD1340FC85432E18E469AA9F2CE945C760

Function 00007FF75917D240 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917D41A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75917D420

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 519950041a37785aba7c92ea2ad4af4fbc7927a04b6b4d80e236ed0b3d606ec2
Instruction ID: ffc04d98975f8fc47f79bf0db26212ce623deac42cd0e2644f9878bd6d0cbc27
Opcode Fuzzy Hash: 519950041a37785aba7c92ea2ad4af4fbc7927a04b6b4d80e236ed0b3d606ec2
Instruction Fuzzy Hash: 4951D166B08B9692EE11AF21E1442ADA370FB14BC4F984635DF6C07792CF38F995D360

Function 00007FF75915C9E0 Relevance: 3.1, APIs: 2, Instructions: 136COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75915CB94
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75915CB9A

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: a4f9ad9fb281da46122b0398a0786db245a8c18b24bfbe1e926cb6c9c603b537
Instruction ID: 3f377f7587adaef9e0d043b9e17883e4cd94c043337ff9a1866cd5c2bbdd1c5b
Opcode Fuzzy Hash: a4f9ad9fb281da46122b0398a0786db245a8c18b24bfbe1e926cb6c9c603b537
Instruction Fuzzy Hash: F351DEA270AB9192EE10EF25E0442ADA371FB08BD8F994632EEAD07785DF3CD545C350

Function 00007FF759138820 Relevance: 3.1, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591389B5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591389BB

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 0625e2a57b2940f18aecb30958d785381e2e5ab939295e65a8d30287c75f6061
Instruction ID: 0819d76b08ed80b310b847eadc5e153407928b8cf8629b3fc4204746e5f81192
Opcode Fuzzy Hash: 0625e2a57b2940f18aecb30958d785381e2e5ab939295e65a8d30287c75f6061
Instruction Fuzzy Hash: 4441AE62B08BA685EE10AF12B4042ADA771FB49BD4F980675DFAD0B7C5DF3CE4418350

Function 00007FF7591738E0 Relevance: 3.1, APIs: 2, Instructions: 119COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNEL32 ref: 00007FF759173970
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759173AAC

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: InformationVolume_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4269842375-0
Opcode ID: daf7d35b7e190df96b7e5e99b91db70cc726afa20a62cf2b8c819ebe6e2caca5
Instruction ID: 9d31db219c89e21995c2bba37c058af19ed926cbecf26a4934d9ec7fcdc64a03
Opcode Fuzzy Hash: daf7d35b7e190df96b7e5e99b91db70cc726afa20a62cf2b8c819ebe6e2caca5
Instruction Fuzzy Hash: EC51AF33E18B9189EB10DF68E4403ADB3B4FB89788F944221EB8C53A99DF78D585C750

Function 00007FF7591389D0 Relevance: 3.1, APIs: 2, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759138B4C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759138B52

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: f2f6d2dee27b991e442a951bfe8c8af2a4e38b6cfd175bab8ff4242bc59d175e
Instruction ID: bd8a2294326bf76dbfcbeb571b94de86eeceabf68cae42399544d5c5d7ef4484
Opcode Fuzzy Hash: f2f6d2dee27b991e442a951bfe8c8af2a4e38b6cfd175bab8ff4242bc59d175e
Instruction Fuzzy Hash: 2F41D3A2B0976685FE11BF16B4043A9E271AB04BD4F9C4631DE6D0B7C9DF3CE5418320

Function 00007FF7591386B0 Relevance: 3.1, APIs: 2, Instructions: 109COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75913880B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759138811

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: b25afc3407e316d0a1ac23ada3eac79bbc304c6b9082724a0b3c479f452ea344
Instruction ID: d9b3338124868f5cbcd892a8aab2e2154f6e0525f00f3943a2f1a9f69503623f
Opcode Fuzzy Hash: b25afc3407e316d0a1ac23ada3eac79bbc304c6b9082724a0b3c479f452ea344
Instruction Fuzzy Hash: CC31BF62B097A695EE10AF16B544369E276AB04BD4F9C0631DE6D0BBC5DF3CE041C360

Function 00007FF7591327F0 Relevance: 3.1, APIs: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591328F2
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591328F8

Part of subcall function 00007FF75911DF10: __std_exception_copy.LIBVCRUNTIME ref: 00007FF75911DF58

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2371198981-0
Opcode ID: a2a7ade0f6edcc97cde3f6362f44c01b02e4d2e372d71427fb8b2e04ca0224a3
Instruction ID: 959c478aceb76c0fb612c4c3fbd1d5912a813b6e9bb916e72bd5b0f2f731daec
Opcode Fuzzy Hash: a2a7ade0f6edcc97cde3f6362f44c01b02e4d2e372d71427fb8b2e04ca0224a3
Instruction Fuzzy Hash: B921B162E09B6641EE19BF15B100378A2B0AB54BA4F684B31DA7C07BD5EF38D5D29350

Function 00007FF7591825CC Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7591825F3

Part of subcall function 00007FF759182580: _invalid_parameter_noinfo.LIBCMT ref: 00007FF759182597

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7591826A7

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4db28ec5cc50d85a6b518035f2d6b552d0c87938a9db18554e7d210b234c6b03
Instruction ID: 469632a6bf50c8eec70ba7b7fc1872df6fcf23815ffe18be9aa58b5be5a8fb26
Opcode Fuzzy Hash: 4db28ec5cc50d85a6b518035f2d6b552d0c87938a9db18554e7d210b234c6b03
Instruction Fuzzy Hash: 6B318D62A18A5282FE51FF14F4501B9E371AB95B90FEC0931E90E4B3D1EF3CE0059321

Function 00007FF759169DAD Relevance: 3.1, APIs: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32 ref: 00007FF759169DBF
CloseHandle.KERNEL32 ref: 00007FF759169DC8

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID:
API String ID: 4207627910-0
Opcode ID: aa5fa85fa8e728178b044d037fe6a01179fd1bc850dc1ee6fe869c6e3a1823c8
Instruction ID: ae393466aa0226915f4d0c061f6ac2a3bdc0bf97f2b55c5504f96e2e49b5f608
Opcode Fuzzy Hash: aa5fa85fa8e728178b044d037fe6a01179fd1bc850dc1ee6fe869c6e3a1823c8
Instruction Fuzzy Hash: 07310B22A1D5D551EE30BF64F5513F9D222AFC1390FC91631E69E82AEADF2CE9848710

Function 00007FF75916AB30 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF75916AB81
RegCloseKey.ADVAPI32 ref: 00007FF75916AB93

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 0ffc730ecf2342cc06a5aca2ef89bfa28c2d566f0630244351f65dc329e80760
Instruction ID: 484083defd240672c3fe23d5ca4616b2f4cb08b697449f221758d732912b7c4e
Opcode Fuzzy Hash: 0ffc730ecf2342cc06a5aca2ef89bfa28c2d566f0630244351f65dc329e80760
Instruction Fuzzy Hash: 70219E22B19A9145FE90AF21F8402BAE375EF99BD4F9C5131EA4D43B99DF2CD481C710

Function 00007FF759196DD0 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF759196DBC,?,?,?,?,00000000,00007FF759196EC5), ref: 00007FF759196E1C
GetLastError.KERNEL32(?,?,?,?,?,00007FF759196DBC,?,?,?,?,00000000,00007FF759196EC5), ref: 00007FF759196E26

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fa5c7f9d9058102a339b1f8801f6c71374a1739474c7be3f72ee9b3e1220e4dc
Instruction ID: 2d37193e6d2018f12cfe7a46df5021f8b7e75e37a69a12da23c20fe1865f34f6
Opcode Fuzzy Hash: fa5c7f9d9058102a339b1f8801f6c71374a1739474c7be3f72ee9b3e1220e4dc
Instruction Fuzzy Hash: 31119D62A18B9181EE50AF25F504069E672AB85BF4F984331EA7D077E9CF3CE4118750

Function 00007FF7591A5FD8 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591A6008

Part of subcall function 00007FF7591A702C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7591A7035

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591A600E

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 700c0b634ef59ceaedef228731b8f5f3f8ef2add7014226fde75a431e4dcd748
Instruction ID: 997fbd8b8f1442bbed8f32fe89e3b440af0fd5fc5b712e32770c1f9e2c0f4494
Opcode Fuzzy Hash: 700c0b634ef59ceaedef228731b8f5f3f8ef2add7014226fde75a431e4dcd748
Instruction Fuzzy Hash: E8E0EC41E0D22746FD283D713A0607980640F197B0E9C1B30ED7D046C7EF2CA89551F4

Function 00007FF7591947C0 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,FFFFFFFFF0B8480A,00007FF75919F1B2,?,?,?,00007FF75919F52F,?,?,00000000,00007FF75919D281,?,?,00007FF7591A366E,00007FF75919D1B3), ref: 00007FF7591947D6
GetLastError.KERNEL32(?,?,FFFFFFFFF0B8480A,00007FF75919F1B2,?,?,?,00007FF75919F52F,?,?,00000000,00007FF75919D281,?,?,00007FF7591A366E,00007FF75919D1B3), ref: 00007FF7591947E0

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: abaf095cda3fb664b3aa4b8c8c2c8800b2f27dab971ce25a3c5a706c4b96f9de
Instruction ID: 25d00dd831b5992d4fbdc479a71d3b7b7e8b430e6d15f935b54e09b0f72b24f0
Opcode Fuzzy Hash: abaf095cda3fb664b3aa4b8c8c2c8800b2f27dab971ce25a3c5a706c4b96f9de
Instruction Fuzzy Hash: 3EE08C11F1921282FF487FF26884035E2B26F88740FCC4874C91D82292EF2CA8424A70

Function 00007FF759144090 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759144397

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: fd8e0c4108cd1e3927597f560e951c282dd2146de47eb043a29a3e71d64c0dfa
Instruction ID: fdd6150a83b53a2bfebe417df1b33ecb0e343abe8eddfffdb79a6ee3a83122bd
Opcode Fuzzy Hash: fd8e0c4108cd1e3927597f560e951c282dd2146de47eb043a29a3e71d64c0dfa
Instruction Fuzzy Hash: DBB16F73B04A518AEF209F25E0902ACB3B0FB58B58F885632EA5D47B98EF38D555D710

Function 00007FF75917B4F0 Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917B6D9

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 51208261318c62c483e9bcd2ad2d630718f50dac3a32fa5733b3a02c9623a713
Instruction ID: 700b2119f0a79b35a9e58f4bd1397ffc27322e015d14100f787f9d1a9dd241ac
Opcode Fuzzy Hash: 51208261318c62c483e9bcd2ad2d630718f50dac3a32fa5733b3a02c9623a713
Instruction Fuzzy Hash: 4351E612F08B928AFF119F78E5403BCB375AF54758F885220DF4D26A96DF38E9918354

Function 00007FF759194CC0 Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF759194CE8

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d288ce3a8f59af22e61a658f6af3622335df89bf5086d992f7d666a51fee3126
Instruction ID: 5598b2de0adfc9843ea8d68eaacc9a6283afc6215ac09b6a53ebcd77c32d9c06
Opcode Fuzzy Hash: d288ce3a8f59af22e61a658f6af3622335df89bf5086d992f7d666a51fee3126
Instruction Fuzzy Hash: 3841B4329196224BEE74AF19F540279F3B2EB56B94F982530E69E476D0CF2CE402C761

Function 00007FF759173610 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759173797

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 86d41cfbe56906a9cd3cde00b6a43299cd1d66e4e06397e6a9af144c57895a4b
Instruction ID: 8c94c61d0906d2cd6364f5f8a4f39d0c4afebf76e3b861586714573df1a469d2
Opcode Fuzzy Hash: 86d41cfbe56906a9cd3cde00b6a43299cd1d66e4e06397e6a9af144c57895a4b
Instruction Fuzzy Hash: AF414932B15B489EEB009FB9E4403AC73B5E74C79CF444625EE9C66B89EF34916483A4

Function 00007FF759196740 Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7591967C6

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d6a424a1862e252f104d98a22ed7854e0b12ee2544baf2a2213fde03138f9aae
Instruction ID: 127f43054417b1b0a84e2cce601c3b7244b302c155f893f6f578474c9587b110
Opcode Fuzzy Hash: d6a424a1862e252f104d98a22ed7854e0b12ee2544baf2a2213fde03138f9aae
Instruction Fuzzy Hash: 7A31AC22E1862286FB557F15A84137DEAB1AF40BA4F890535EA2D037D2DF7CE4428731

Function 00007FF759131EE0 Relevance: 1.6, APIs: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759131FD7

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e01a55cb725a310083d2f595ddc2a94c0a647fb3d167e5d0746f9d0ff0537399
Instruction ID: d20cd01ffa9618376bbc27e796ba77113930128daafa00f62e9ee1b8322b08d2
Opcode Fuzzy Hash: e01a55cb725a310083d2f595ddc2a94c0a647fb3d167e5d0746f9d0ff0537399
Instruction Fuzzy Hash: 59311676609B4982EF159F69E05026CB3B9FB48F98B988432DE0D07768DF3CE845C350

Function 00007FF7591CCCA0 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00007FF7591C323C), ref: 00007FF7591CCD8C

Part of subcall function 00007FF7591CC560: UnmapViewOfFile.KERNEL32 ref: 00007FF7591CC570
Part of subcall function 00007FF7591CC560: UnmapViewOfFile.KERNEL32 ref: 00007FF7591CC581

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: FileUnmapView$CriticalDeleteSection
String ID:
API String ID: 1429322562-0
Opcode ID: 4c0bf50b2a727a2101c6b768742399a8d0290827343191bf247b63edcd83cbbf
Instruction ID: b725cb48fb7b46d95d518c6a2083024abb7d17af429ba9ba311a851efd6667da
Opcode Fuzzy Hash: 4c0bf50b2a727a2101c6b768742399a8d0290827343191bf247b63edcd83cbbf
Instruction Fuzzy Hash: E7312936A18B6186EB10EF22F54006AB7B4FB48B98F881435DF8D07B59DF38E865C754

Function 00007FF7591E1B08 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7591E1B2B

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 70bf896b561adad378154b5a9aa75eb806a5c363bda8e4fba91d540825785324
Instruction ID: 582c3d24d7e9d2f19d09b40b6b507f52bf71efc6e84eb0f635aeefbe59456fb5
Opcode Fuzzy Hash: 70bf896b561adad378154b5a9aa75eb806a5c363bda8e4fba91d540825785324
Instruction Fuzzy Hash: CE219532618A428BDF61AF18F540379BAB1EB84B54F984238EB5D4B6D5EF3CD4058B10

Function 00007FF7591DFCD4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7591DFC31

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 61b874b2431c390e4c3ce94b2b4c494386b5c7e2e88d760d95cc96ba2d081e1a
Instruction ID: a3f3ac87a1e1902af91fb0f9adf52a7d0bcaa6b5a72a6ea6e6b8c96073a937c3
Opcode Fuzzy Hash: 61b874b2431c390e4c3ce94b2b4c494386b5c7e2e88d760d95cc96ba2d081e1a
Instruction Fuzzy Hash: C7115E22A2C76181FEA0BF51B40057AE2B0AF85B84F8C4431EE5D47B86DF3CE6519761

Function 00007FF759131830 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759131881

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: b2df9d5378af7644bf44556ef3f368e970deba10919b859e3595f3679306f833
Instruction ID: 9053768d5d3e734afd2596fcbdb416439387145dee60ad22e8e876a554c343b4
Opcode Fuzzy Hash: b2df9d5378af7644bf44556ef3f368e970deba10919b859e3595f3679306f833
Instruction Fuzzy Hash: 57F0A7A2B16B8988EF08AE75E45437CA2B59B08F84F984430CA0C46345EF2CC4918310

Function 00007FF759128323 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE ref: 00007FF759128366

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 023abc5ec8dec306f4c56b2b1cb79829ee1d5b09c77f80c48eebe4a5235393d5
Instruction ID: 5291c7fcae3c8b2ee076740ddf9f3e86fe3fbda3826d641dd64379f8a842b2ca
Opcode Fuzzy Hash: 023abc5ec8dec306f4c56b2b1cb79829ee1d5b09c77f80c48eebe4a5235393d5
Instruction Fuzzy Hash: 7D01442660CA8180EE70EF52F4542AAE374FB88B94F884032CE8D43B59DF3DD8468B00

Function 00007FF759142D68 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759142DB7

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 039b756a34462ec9c9354c6cef394967c077d061809f4352b933bc9947441af2
Instruction ID: 10067aa07ef12dc921fc595b5cb884e0251b17ad0d75bc66daa7334542c6a7d2
Opcode Fuzzy Hash: 039b756a34462ec9c9354c6cef394967c077d061809f4352b933bc9947441af2
Instruction Fuzzy Hash: FBF030A6F0469541FF19AE24E05436DA362DB14F89F984831D70C0EA8AEFBDD8C08291

Function 00007FF759182CE4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF759182D03

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bfd1af2436c86cf97cc9b7188a38bc2e51aa77262de0214f2f9b059f75a9b1dc
Instruction ID: c2763d6b7e4b366dc68f51a215a900d7c81cd230bea4c7cfcef317bd0950748c
Opcode Fuzzy Hash: bfd1af2436c86cf97cc9b7188a38bc2e51aa77262de0214f2f9b059f75a9b1dc
Instruction Fuzzy Hash: A9E0ED31A09A1241FF263EA5B14013CF2B09F447F0F984B32EA3C0A2C6DF2C94906222

Function 00007FF7591DB4F0 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,?,?,?,00007FF759120B49), ref: 00007FF7591DB4F4

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 53218ea80e347e6865bdeee8b0f03a3a5d87b1e304366d91bc4bbfa512aed3a1
Instruction ID: 1936eb540439a0e4fc0ac5ba1329f467f9aecf3917844a400b034cd753e7519a
Opcode Fuzzy Hash: 53218ea80e347e6865bdeee8b0f03a3a5d87b1e304366d91bc4bbfa512aed3a1
Instruction Fuzzy Hash: 5BC04C15F59612C1FA943F726C8612191B46B58700FC84031C20980151DF5CA1974A21

Function 00007FF7591DD0E4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00007FF7591DD0ED

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 31ef5172387b0c087c3910bc7c9ebda6b906d006f82425aae53580b4b20e881b
Instruction ID: 75c4d6f8c5739e951e15733cf1a63e229a0d0c73545644a4b0f80e4b8982ed3a
Opcode Fuzzy Hash: 31ef5172387b0c087c3910bc7c9ebda6b906d006f82425aae53580b4b20e881b
Instruction Fuzzy Hash: C1B09226A188C0C3D611FF04E842029B331FB94B08FD00021E28D42628CF2CEA6A8F10

Function 00007FF7591CCE70 Relevance: 1.4, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7591CC4B0: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF7591CCE94,00000001,?,?,00007FF7591CCC81), ref: 00007FF7591CC4C4

InitializeCriticalSection.KERNEL32(00000001,?,?,00007FF7591CCC81,?,?,00000000,00007FF7591C31DB,?,?,00000000,00007FF7591AFA01), ref: 00007FF7591CCF40

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: CriticalInfoInitializeSectionSystem
String ID:
API String ID: 3396500325-0
Opcode ID: dc4482ca8e0435746fbe169b04928ad9b92026c57d372a0786afd09550947472
Instruction ID: 0f13167b3e71642ec34d96f113c88a137a27c7e1119a85c54f48070ec15193ba
Opcode Fuzzy Hash: dc4482ca8e0435746fbe169b04928ad9b92026c57d372a0786afd09550947472
Instruction Fuzzy Hash: 80419F32A04B958AEB10EF16F54055DFBB8FB64B90B988435DF9943B50DF38E991C710

Function 00007FF759194E28 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7591913E2,?,?,00009576C16D8760,00007FF759188599,?,?,?,?,00007FF759194C7A,?,?,00000000), ref: 00007FF759194E7D

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 93459845f911a6eca184272eb9e7dca726b4e6dbea886ee78a2622d72edc0e7b
Instruction ID: e76364879676e0d870fe3811b0d4b15d566c19f98e236ecf3a84ce927ecdeb76
Opcode Fuzzy Hash: 93459845f911a6eca184272eb9e7dca726b4e6dbea886ee78a2622d72edc0e7b
Instruction Fuzzy Hash: D8F06D44B0963281FE547EA17A503B5D2B65F88B80FCC6530C90E867C2EF1CE8814671

Function 00007FF75919714C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF759194C61,?,?,00000000,00007FF7591A4FAB,?,?,?,00007FF7591A3397,?,?,?,00007FF7591A328D), ref: 00007FF75919718A

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 4ecfee661c4bf62e861df5f9f5e7a1dae78cf794a289f64c5eca19dba9fd3138
Instruction ID: 03487c07704d2db947977cac1c43baa40010cdd3d37c3a8fb9910849161ba9e2
Opcode Fuzzy Hash: 4ecfee661c4bf62e861df5f9f5e7a1dae78cf794a289f64c5eca19dba9fd3138
Instruction Fuzzy Hash: 58F05815B0926B47FE543EA179406B5D2B15F88BA4FCC0A30DC2F856C2DF2CA8418230

Function 00007FF7591CC530 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00007FF7591C323C), ref: 00007FF7591CC53C

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: dac610213d391720b387916774ff12a690399de04c291ef470cfe5691dd3be78
Instruction ID: 056607c57d41d6795b747dc9b82cc4a01d3074116a26d7bc0949c2b997c6ffcf
Opcode Fuzzy Hash: dac610213d391720b387916774ff12a690399de04c291ef470cfe5691dd3be78
Instruction Fuzzy Hash: 32C04C10B1995042FB8C772B5C5B32690926FCC701FD48439DA0FC2665DD1C99564A10

Non-executed Functions

Function 00007FF7591B6C00 Relevance: 60.8, APIs: 20, Strings: 14, Instructions: 1262COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7591B3020: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B314C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8127
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B812D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8133
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8139
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B813F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8145
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B814B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8151
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8157
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B815D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8163
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8169
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B816F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B817B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8187
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B818D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8193
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8199
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B819F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B81A5

Strings

Unexpected register: , xrefs: 00007FF7591B7FA1
mov, xrefs: 00007FF7591B6DC9
dword, xrefs: 00007FF7591B6E0C
r14, xrefs: 00007FF7591B79B4
Unexpected scratch register: , xrefs: 00007FF7591B784A
eax, xrefs: 00007FF7591B6DE6, 00007FF7591B6EAB
qword, xrefs: 00007FF7591B6CE9
r15, xrefs: 00007FF7591B75CC, 00007FF7591B7969, 00007FF7591B79BB
Failed to detect pointer size: , xrefs: 00007FF7591B70DB
invalid map<K, T> key, xrefs: 00007FF7591B81AB
rax, xrefs: 00007FF7591B6DDF
byte, xrefs: 00007FF7591B6F29
word, xrefs: 00007FF7591B6ED3
Unexpected size of immediate: , xrefs: 00007FF7591B7506

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: Failed to detect pointer size: $Unexpected register: $Unexpected scratch register: $Unexpected size of immediate: $byte$dword$eax$invalid map<K, T> key$mov$qword$r14$r15$rax$word
API String ID: 3668304517-2329226126
Opcode ID: b58ef5277d2c44e18dcb20cc262d2c2bdccf4d7b2df8462764bdf356cd7069db
Instruction ID: 1a20f73f7b0e53bf7b84c11f50569d420123810ce8ac0348ae47d31ac2cd3c26
Opcode Fuzzy Hash: b58ef5277d2c44e18dcb20cc262d2c2bdccf4d7b2df8462764bdf356cd7069db
Instruction Fuzzy Hash: 57D2C562A18BD585EF21AF24D8443ECA373FB557A8F985231DA6D07ADADF38D580C310

Function 00007FF759184EC0 Relevance: 49.1, APIs: 25, Strings: 2, Instructions: 1888COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7591851F7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75918545A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF75918571D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7591859BD
memcpy_s.LIBCPMT ref: 00007FF759185BCA
memcpy_s.LIBCPMT ref: 00007FF759185C66
memcpy_s.LIBCPMT ref: 00007FF75918611E
memcpy_s.LIBCPMT ref: 00007FF759186159
memcpy_s.LIBCPMT ref: 00007FF759186285
memcpy_s.LIBCPMT ref: 00007FF7591863AC
memcpy_s.LIBCPMT ref: 00007FF759186457
memcpy_s.LIBCPMT ref: 00007FF75918649F
memcpy_s.LIBCPMT ref: 00007FF7591864C9
memcpy_s.LIBCPMT ref: 00007FF75918657A
memcpy_s.LIBCPMT ref: 00007FF75918677A
memcpy_s.LIBCPMT ref: 00007FF7591867BF
memcpy_s.LIBCPMT ref: 00007FF759186876
memcpy_s.LIBCPMT ref: 00007FF7591869A3
memcpy_s.LIBCPMT ref: 00007FF75918606E

Part of subcall function 00007FF759187304: _invalid_parameter_noinfo.LIBCMT ref: 00007FF759187336

memcpy_s.LIBCPMT ref: 00007FF7591860E9
memcpy_s.LIBCPMT ref: 00007FF759186B5D

Strings

, xrefs: 00007FF759186923
, xrefs: 00007FF759186A50

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: 5e39915bf05eb7d447e4c5a4b771afda0dddd5ff4239f102f908e97f1b882645
Instruction ID: 05fa4b839347a34402c43e07559d8a8c83054824ba342b95d8fb6bf34ff489f5
Opcode Fuzzy Hash: 5e39915bf05eb7d447e4c5a4b771afda0dddd5ff4239f102f908e97f1b882645
Instruction Fuzzy Hash: B903D572A142D18FFB759F24E8507EEB7B1FB44388F885135DA0A57B48DB39AA00DB11

Function 00007FF759141070 Relevance: 39.9, APIs: 11, Strings: 11, Instructions: 1388COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75914264C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759142679
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759142742
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759142748
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75914274E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759142754
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759142781
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591427FC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759142802
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759142856
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591428AA

Strings

Unexpected eof, xrefs: 00007FF759142652
key opened, but never closed, xrefs: 00007FF75914282F
#include, xrefs: 00007FF759141ADA
No closed word, xrefs: 00007FF759142787, 00007FF7591427AE
unexpected key without object, xrefs: 00007FF75914275A
#base, xrefs: 00007FF759141B06
object is not closed with '}', xrefs: 00007FF75914267F
key declared, but no value, xrefs: 00007FF7591426CD, 00007FF7591426F4, 00007FF759142808
word wasnt properly ended, xrefs: 00007FF7591427D5, 00007FF75914285C
quote was opened but not closed., xrefs: 00007FF7591426A6, 00007FF75914271B
unexpected '}', xrefs: 00007FF759142883

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: #base$#include$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 3936042273-1838291449
Opcode ID: dc4b0996f4d560a1900f6aa60d1b3906785f39088b617cb86e705d648385a59c
Instruction ID: f387f4ce90ad3fa22073111dbf8a4c295f6944360e02642357ef066ef0535c62
Opcode Fuzzy Hash: dc4b0996f4d560a1900f6aa60d1b3906785f39088b617cb86e705d648385a59c
Instruction Fuzzy Hash: D2E29372A057D685EF71AF20E9403ECA3B1FB19798F884531DA4D0BA99EF78D685C310

Function 00007FF7591682D0 Relevance: 33.7, APIs: 8, Strings: 11, Instructions: 465COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32 ref: 00007FF759168857
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759168A42
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759168A48
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759168A4E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759168A54
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759168A5A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759168A60
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759168AB5

Strings

.exe, xrefs: 00007FF759168335
.cmd, xrefs: 00007FF759168393
open, xrefs: 00007FF7591687CD
ios_base::eofbit set, xrefs: 00007FF759168A7C
runas, xrefs: 00007FF7591687D6
.ps1, xrefs: 00007FF759168364
ios_base::badbit set, xrefs: 00007FF759168A6A
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 00007FF759168464
.exe, xrefs: 00007FF75916841D
ios_base::failbit set, xrefs: 00007FF759168A75
.vbs, xrefs: 00007FF7591683C2

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ExecuteShell
String ID: .cmd$.exe$.exe$.ps1$.vbs$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas
API String ID: 4120902618-4093014531
Opcode ID: be63988a5b8f2af6a64ad92dbab525889649630b6bd7050345156fc1b4cf4a77
Instruction ID: 6f608068dbc228162d1ed9a20a91d0cdd68f00227ee07e7cdaaa954340a1b0d8
Opcode Fuzzy Hash: be63988a5b8f2af6a64ad92dbab525889649630b6bd7050345156fc1b4cf4a77
Instruction Fuzzy Hash: 3D22B072E14B9185EB10EF28E4803EDA7B1FB84798F945236EA5D03AA9DF78D584C350

Function 00007FF759128B60 Relevance: 31.1, APIs: 15, Strings: 2, Instructions: 1345COMMON

Download Yara Rule

Strings

Software, xrefs: 00007FF759128FDE, 00007FF7591291B6
exists, xrefs: 00007FF75912A128

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID: Software$exists
API String ID: 0-2364128853
Opcode ID: 21eb7221288b317c2b462c652c3d4c6b67b3fe8d2c610f7f74298872afd642f5
Instruction ID: 675150c66cf988f2c5083099a76ea473f07dfff6c9611bb3397da646d6d502dc
Opcode Fuzzy Hash: 21eb7221288b317c2b462c652c3d4c6b67b3fe8d2c610f7f74298872afd642f5
Instruction Fuzzy Hash: F1D27F72A04BD58AEF10AF29E4403EDB3B0FB49798F944221EA9D17B99DF79D581C310

Function 00007FF7590F7460 Relevance: 30.2, Strings: 24, Instructions: 238COMMON

Download Yara Rule

Strings

winsipolicy.p7b, xrefs: 00007FF7590F7598
boot.sdi, xrefs: 00007FF7590F77B1
autorun.inf, xrefs: 00007FF7590F7488
bootmgr, xrefs: 00007FF7590F783E
ntuser.dat, xrefs: 00007FF7590F75E4
reagent.xml, xrefs: 00007FF7590F780F
ntldr, xrefs: 00007FF7590F7572
bootfont.bin, xrefs: 00007FF7590F7500
thumbs.db, xrefs: 00007FF7590F7668
desktop.ini, xrefs: 00007FF7590F754C
iconcache.db, xrefs: 00007FF7590F75BE
winre.wim, xrefs: 00007FF7590F77E0
bootstat.dat, xrefs: 00007FF7590F76F5
bootsect.bak, xrefs: 00007FF7590F7526
wpsettings.dat, xrefs: 00007FF7590F7782
indexervolumeguid, xrefs: 00007FF7590F7753
ntuser.dat.log, xrefs: 00007FF7590F760D
BOOTNXT, xrefs: 00007FF7590F786D
ntuser.ini, xrefs: 00007FF7590F7639
mib.bin, xrefs: 00007FF7590F7724
gdipfontcachev1.dat, xrefs: 00007FF7590F7697
bootmgfw.efi, xrefs: 00007FF7590F74D9
d3d9caps.dat, xrefs: 00007FF7590F76C6
boot.ini, xrefs: 00007FF7590F74B1

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: BOOTNXT$autorun.inf$boot.ini$boot.sdi$bootfont.bin$bootmgfw.efi$bootmgr$bootsect.bak$bootstat.dat$d3d9caps.dat$desktop.ini$gdipfontcachev1.dat$iconcache.db$indexervolumeguid$mib.bin$ntldr$ntuser.dat$ntuser.dat.log$ntuser.ini$reagent.xml$thumbs.db$winre.wim$winsipolicy.p7b$wpsettings.dat
API String ID: 73155330-850610325
Opcode ID: 54d700b9cf3b2f1ca1d9d49bc365dd1e4e44872a710e548b6f8f77ba2ac0658b
Instruction ID: fdc3d573232554c0f0dd2276c37c8cde70d0c52ee37fd2eb5b6a3b1550a8a1a0
Opcode Fuzzy Hash: 54d700b9cf3b2f1ca1d9d49bc365dd1e4e44872a710e548b6f8f77ba2ac0658b
Instruction Fuzzy Hash: BAC1A652D64BCA84FB11EF35D8813F5A372FBEA344F986332A54861856AF68B7C4C340

Function 00007FF759177C90 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 351nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF759177CD6
GetProcAddress.KERNEL32 ref: 00007FF759177CE6
OpenProcess.KERNEL32 ref: 00007FF759177D18
NtQuerySystemInformation.NTDLL ref: 00007FF759177D40
NtQuerySystemInformation.NTDLL ref: 00007FF759177D6E
GetCurrentProcess.KERNEL32 ref: 00007FF759177E33
NtQueryObject.NTDLL ref: 00007FF759177E79
GetFinalPathNameByHandleA.KERNEL32 ref: 00007FF759177F6D
CloseHandle.KERNEL32 ref: 00007FF759178088
CloseHandle.KERNEL32 ref: 00007FF759178118
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591781A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591781AB

Strings

File, xrefs: 00007FF759177EAA
NtDuplicateObject, xrefs: 00007FF759177CDF
ntdll.dll, xrefs: 00007FF759177CCF

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Handle$Query$CloseInformationProcessSystem_invalid_parameter_noinfo_noreturn$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 1269246921-3955674919
Opcode ID: a624ba69bbab064b290267bb95dc78188409e9aeb6f61e2e23a31bd26d907d92
Instruction ID: 15ab5ecd2b53f31557c5e7208c7e40a7e7abbadb818c867c6101f9f4cf758a52
Opcode Fuzzy Hash: a624ba69bbab064b290267bb95dc78188409e9aeb6f61e2e23a31bd26d907d92
Instruction Fuzzy Hash: 95E1C162B18A9289FF00EF65E4503BCA3B1EB44B88F884531DE5D17B99DF3CE9498310

Function 00007FF759161F40 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 00007FF759161F9F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916233A

Strings

@, xrefs: 00007FF759162126

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_noreturn
String ID: @
API String ID: 3490963316-2766056989
Opcode ID: e3184df6f98de2c4f70b60a1088b1e91bd73b10e136101af35ae729ded4fa57a
Instruction ID: 699a11f51bc4676c01e27ba8ad4ba86106c7a90717871694bc5f45578d520ebe
Opcode Fuzzy Hash: e3184df6f98de2c4f70b60a1088b1e91bd73b10e136101af35ae729ded4fa57a
Instruction Fuzzy Hash: 01A18922F08A918AFB10EF24E4042ADB771FB88B88F484635DE5E57A98DF3CE555C354

Function 00007FF759122C90 Relevance: 23.5, APIs: 8, Strings: 5, Instructions: 747COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591238E3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591238FF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759123915
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912392B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759123931
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912394F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759123955
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912395B

Part of subcall function 00007FF75911FAB0: __std_fs_code_page.LIBCPMT ref: 00007FF75911FAE7
Part of subcall function 00007FF75911FAB0: __std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF75911FB2E
Part of subcall function 00007FF75911FAB0: __std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF75911FB6A

Strings

directory_iterator::directory_iterator, xrefs: 00007FF7591238F2, 00007FF759123942
content, xrefs: 00007FF7591232F6
exists, xrefs: 00007FF7591238D6
filename, xrefs: 00007FF75912323E
status, xrefs: 00007FF759123908, 00007FF75912391E

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 2212124024-3429737954
Opcode ID: c10b546fdc0c3b7e801e1a9528fb045b7b360e675c49147f11787a7d32182118
Instruction ID: f7e02b3839ecb119c8b689cc39579c18da1df1ab7165f6c9e3349f9793c5e9b4
Opcode Fuzzy Hash: c10b546fdc0c3b7e801e1a9528fb045b7b360e675c49147f11787a7d32182118
Instruction Fuzzy Hash: 38728072A08BD585EF21AF25E8403EDA370FB89B94F885231DA5D47B99EF38D645C310

Function 00007FF7591B1BC0 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 370COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B1FDC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B1FE2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B1FE8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B1FEE

Strings

mov rax, , xrefs: 00007FF7591B1C68, 00007FF7591B1CD5
ret , xrefs: 00007FF7591B1E67, 00007FF7591B1ED4, 00007FF7591B2009
push rax, xrefs: 00007FF7591B1C12
xchg [rsp], rax, xrefs: 00007FF7591B1E0F

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: mov rax, $push rax$ret $xchg [rsp], rax
API String ID: 3668304517-2795999732
Opcode ID: 1195ee188e078e44d3601f79d653ee8fda8fc6ecdcce4321e206fd54c07996e0
Instruction ID: e88f241ee4f6966997e3a2617a7064b1375ef06d550608416e8338d10d601cd7
Opcode Fuzzy Hash: 1195ee188e078e44d3601f79d653ee8fda8fc6ecdcce4321e206fd54c07996e0
Instruction Fuzzy Hash: 56E1E062B08A9186FB10EF65E5403ADA372FB05B98F894631DE5C07699DF3CE585C320

Function 00007FF75917C090 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF75917C273
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917C2FD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917C303
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917C309
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917C30F

Strings

out_of_range, xrefs: 00007FF75917C102
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FF75917C39F

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$out_of_range
API String ID: 1944019136-2497706888
Opcode ID: 6594c139335a1207bc39d654f26e50ae82b368122471accea4e33488c68bf5a0
Instruction ID: f3b69d7210d1804b63fa1fcb2fb96192ac731fe67355fe04179ec04f5107d72d
Opcode Fuzzy Hash: 6594c139335a1207bc39d654f26e50ae82b368122471accea4e33488c68bf5a0
Instruction Fuzzy Hash: F0A1C062F18B9285FB009F64E0413ACA372EB59798F989232EA5D17B99DF3CD585C310

Function 00007FF7591BBC80 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 633COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591BBEDB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591BBEE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591BC5F3

Strings

m_fnAddress: , xrefs: 00007FF7591BBC8E
Original function:, xrefs: 00007FF7591BBC8C
invalid unordered_map<K, T> key, xrefs: 00007FF7591BC5D4

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: Original function:$invalid unordered_map<K, T> key$m_fnAddress:
API String ID: 3668304517-1941141636
Opcode ID: 02981d798371a4823a731deade04a4b5622e736bbf8c915eaae5eee91cb6dc46
Instruction ID: d3a7a83314e4c9457d0dfdd44f2a64950379915f7d3cfe215862f38b90c77796
Opcode Fuzzy Hash: 02981d798371a4823a731deade04a4b5622e736bbf8c915eaae5eee91cb6dc46
Instruction Fuzzy Hash: 2B42F263B1969545EE009F69E4443ADA773EB497E4F988232EEAC47BD9DF3CD4808310

Function 00007FF7591A0D98 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF759191208: GetLastError.KERNEL32 ref: 00007FF759191217
Part of subcall function 00007FF759191208: FlsGetValue.KERNEL32 ref: 00007FF75919122C
Part of subcall function 00007FF759191208: SetLastError.KERNEL32 ref: 00007FF7591912B7

Part of subcall function 00007FF759191208: FlsSetValue.KERNEL32 ref: 00007FF75919124D
Part of subcall function 00007FF759191208: FlsGetValue.KERNEL32 ref: 00007FF7591912ED

GetUserDefaultLCID.KERNEL32 ref: 00007FF7591A0F08

Part of subcall function 00007FF759191208: FlsSetValue.KERNEL32 ref: 00007FF75919127A
Part of subcall function 00007FF759191208: FlsSetValue.KERNEL32 ref: 00007FF75919128B
Part of subcall function 00007FF759191208: FlsSetValue.KERNEL32 ref: 00007FF75919129C
Part of subcall function 00007FF759191208: FlsSetValue.KERNEL32 ref: 00007FF75919130C
Part of subcall function 00007FF759191208: FlsSetValue.KERNEL32 ref: 00007FF759191334

EnumSystemLocalesW.KERNEL32 ref: 00007FF7591A0EEF
ProcessCodePage.LIBCMT ref: 00007FF7591A0F32
IsValidCodePage.KERNEL32 ref: 00007FF7591A0F44
IsValidLocale.KERNEL32 ref: 00007FF7591A0F5A
GetLocaleInfoW.KERNEL32 ref: 00007FF7591A0FB6
GetLocaleInfoW.KERNEL32 ref: 00007FF7591A0FD2

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: d7af4cb43e3a2f5a08089ec48a14d498971702225374197e96c623aa53a81e73
Instruction ID: bda6e804124d31285f4f5cb4842490413b5d0a7bc57bc3d1715f0e6d77340a0e
Opcode Fuzzy Hash: d7af4cb43e3a2f5a08089ec48a14d498971702225374197e96c623aa53a81e73
Instruction Fuzzy Hash: EE713C22B087628AFF50BF71E4506BCA3B0BF46744F884135DA0D53695EF3CA845C7A0

Function 00007FF7591BE500 Relevance: 9.3, Strings: 7, Instructions: 525COMMON

Download Yara Rule

Strings

1to32, xrefs: 00007FF7591BEBC9
1to4, xrefs: 00007FF7591BEB6A
1to16, xrefs: 00007FF7591BEBB3
1to64, xrefs: 00007FF7591BEBDF
1to8, xrefs: 00007FF7591BEB7A
align, xrefs: 00007FF7591BE838
1to2, xrefs: 00007FF7591BEB57

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID: 1to16$1to2$1to32$1to4$1to64$1to8$align
API String ID: 0-1990294269
Opcode ID: 478a5ba8a10261c43c710e93d119ad108c814f434cc3ec5caa3a0798475301f4
Instruction ID: 308f753501ff5eb09cf404fd53a5d80a40765a88065768f6239506810809d58e
Opcode Fuzzy Hash: 478a5ba8a10261c43c710e93d119ad108c814f434cc3ec5caa3a0798475301f4
Instruction Fuzzy Hash: E1221762B1C2A286FF60AE25E0507BDA7B3EB45744FC85432DA4E43685DF3CE941CB94

Function 00007FF759148150 Relevance: 8.0, APIs: 5, Instructions: 491COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591481CA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591481D0
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75914825B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759148261

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 6457c21683431f40fc46ce0097663e54508b7ea26b05d588e75e728b20c3ee12
Instruction ID: 8b98e194c7d3d149e89c05a8d502bde82c882424dacaf9919a42d0a4ebc5bbe1
Opcode Fuzzy Hash: 6457c21683431f40fc46ce0097663e54508b7ea26b05d588e75e728b20c3ee12
Instruction Fuzzy Hash: AA12B162F09B5685EE10EF61E0402ADA371EB48B98F984632DF6D17785EF3CE495C350

Function 00007FF759169F00 Relevance: 7.9, APIs: 5, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF759169F63
ShellExecuteW.SHELL32 ref: 00007FF75916A5AA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916A633
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916A639
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916A63F

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ExecuteFileModuleNameShell
String ID:
API String ID: 3435646932-0
Opcode ID: 48b4ddc7bcf3ada09b84498f3bfe3d6f2476c30260f20d24590befa7b6f1312e
Instruction ID: e1f523056ed6f755bc67ed9bc6c7895dd602f74c06b22fa34449783ef5f55f65
Opcode Fuzzy Hash: 48b4ddc7bcf3ada09b84498f3bfe3d6f2476c30260f20d24590befa7b6f1312e
Instruction Fuzzy Hash: 79123C72A29BD48AEB408F29E88169DB3B4F788798F505225FEDD57B58EF38D150C700

Function 00007FF7591DDBBC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7591DDC1D
IsDebuggerPresent.KERNEL32 ref: 00007FF7591DDC35
OutputDebugStringW.KERNEL32 ref: 00007FF7591DDC46

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7591DDC3F

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 054003f83320035adec44d53329f05feb58a978b0ff87314a16bb39900f58930
Instruction ID: 4d592f808d3ec88a032881701db5321cb51f4a737ab0a9a9e1e2e8453cb77d78
Opcode Fuzzy Hash: 054003f83320035adec44d53329f05feb58a978b0ff87314a16bb39900f58930
Instruction Fuzzy Hash: 22114F32A14B5297FB44AF22EA54379B2B4FF44345F884139C64D86A50EF7CF064C720

Function 00007FF759142F80 Relevance: 6.4, APIs: 4, Instructions: 439COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75914312A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759143136
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759143305
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759143311

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: d0b4d048326b8adc44645d321c1134835be996d6885a44465472921164cc3af2
Instruction ID: f8b5ce62da5b80f2296c6a40870756c2b723241a42038ef650edeb8184946412
Opcode Fuzzy Hash: d0b4d048326b8adc44645d321c1134835be996d6885a44465472921164cc3af2
Instruction Fuzzy Hash: 4602AE62A09B9581EE10AF15F54426DB3B4FB48BE0FA84635DBAD07794EF3CE492C310

Function 00007FF759140E80 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 310COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759141018
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759141064

Strings

conditional not closed, xrefs: 00007FF75914101E, 00007FF759141041

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: conditional not closed
API String ID: 73155330-2481790218
Opcode ID: 1c60a9c5d3a36f4930e48f451563fee15543535cbf0c989a7f65713a5c288c6f
Instruction ID: 94c4aec023c7b8671d6ba8002778490e25751a41e1a8ba6e7542af176282e82b
Opcode Fuzzy Hash: 1c60a9c5d3a36f4930e48f451563fee15543535cbf0c989a7f65713a5c288c6f
Instruction Fuzzy Hash: BED1B032A09BD684EB21DF21E9402FDB7B5FB59784F984136DA4C0BA99EF78D590C310

Function 00007FF75919ADF4 Relevance: 5.5, APIs: 3, Instructions: 1005COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF75919B22A
_get_daylight.LIBCMT ref: 00007FF75919B2C5
_get_daylight.LIBCMT ref: 00007FF75919B2DE

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 47d861683341f54d3090551517d3d7bb1a628ba7c8a4dca3f9e571835d33f049
Instruction ID: d84d17d88ac1e9090be2bcf7c9234cc22ee307ed9c1f31c6cdd8104e5b1d246e
Opcode Fuzzy Hash: 47d861683341f54d3090551517d3d7bb1a628ba7c8a4dca3f9e571835d33f049
Instruction Fuzzy Hash: 5C92DF32A0866686EB64AF25A65017EB7BBFB45BC4F884135DB4E07B94DF3CE514C320

Function 00007FF7591DB1A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,?,?,?,?,00000000,00007FF75911EB49), ref: 00007FF7591DB1C6
FormatMessageA.KERNEL32 ref: 00007FF7591DB1F9

Strings

!x-sys-default-locale, xrefs: 00007FF7591DB1B9

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: d44032de10bca517d3cc3a61524fc6b25f9580e9f75d891d10e8f21147b91806
Instruction ID: c094bcd0862b78f305c9d288f25f984186636b8c6ff27cc488be1fecf879bba4
Opcode Fuzzy Hash: d44032de10bca517d3cc3a61524fc6b25f9580e9f75d891d10e8f21147b91806
Instruction Fuzzy Hash: 0B01A172F0878582FB559F12B54077EA6B6FB85784F884035DA4A46A98DF3CE5048710

Function 00007FF7591B89E0 Relevance: 4.9, APIs: 3, Instructions: 407COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8B20
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591B8B2C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B8C68

Part of subcall function 00007FF7591A5FD8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591A6008
Part of subcall function 00007FF7591A5FD8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591A600E

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4131450254-0
Opcode ID: 5c9538d139d5618201ef3f36c2fc53709358423821e86ab391ce5bbb4f41cd0a
Instruction ID: 84c33bdff5f7d462f28a8348a48220778d19cef624669b2740e3fbd192e58dd0
Opcode Fuzzy Hash: 5c9538d139d5618201ef3f36c2fc53709358423821e86ab391ce5bbb4f41cd0a
Instruction Fuzzy Hash: CDE1F162A09B6581EE10DF22F550279A7A6EB48FD4F988532EE9D17B98DF3CD841C310

Function 00007FF759186DF0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF759186E56
memcpy_s.LIBCPMT ref: 00007FF759186E81

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: eb07a1fe8bff8429000d82fc6708e1dd14e73367c47fa60bb37c8b50ad77a0f3
Instruction ID: ae838cfb9fdd15026f6a653306b072d771eed4d9df88aacdf1b5bcdd635cc228
Opcode Fuzzy Hash: eb07a1fe8bff8429000d82fc6708e1dd14e73367c47fa60bb37c8b50ad77a0f3
Instruction Fuzzy Hash: 18C1F372B1929687EF24DF59F14466AF7A2F784B84F888134DB4A53B84DB3DE900DB40

Function 00007FF759173BA0 Relevance: 4.7, APIs: 3, Instructions: 187COMMON

Download Yara Rule

APIs

EnumDisplayDevicesW.USER32 ref: 00007FF759173CB7
EnumDisplayDevicesW.USER32 ref: 00007FF759173D5B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759173EAF

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: DevicesDisplayEnum$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2655931952-0
Opcode ID: 93f143aaed34d6efebadf67a529ae19b0810b8c687300852e3dcb61448587e56
Instruction ID: 903138449552467477a122ff1fa95845d11f079a2cd8240c5af2c7cffde0927f
Opcode Fuzzy Hash: 93f143aaed34d6efebadf67a529ae19b0810b8c687300852e3dcb61448587e56
Instruction Fuzzy Hash: 28819E32A18B8586EB20DF25F4447AEB7B4F788798F945225EE9C17B98DF38D581C700

Function 00007FF7591BAB70 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591BADE1

Strings

invalid unordered_map<K, T> key, xrefs: 00007FF7591BADE7

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: invalid unordered_map<K, T> key
API String ID: 3668304517-353222475
Opcode ID: 3816611a46f99d454c894934d88facfdf03a6d509af848790ad9a93ba470a137
Instruction ID: 8d349cbe0278f3cebf575106d679890fc08cf8f5de6738e07a32ef3b1c7dbb86
Opcode Fuzzy Hash: 3816611a46f99d454c894934d88facfdf03a6d509af848790ad9a93ba470a137
Instruction Fuzzy Hash: 1581D46371466545FF149F21E4213BCA7B6AB88BC8F889132EA9D0BBD8DF3CD9418350

Function 00007FF759195418 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF75919548C

Strings

GetLocaleInfoEx, xrefs: 00007FF759195434, 00007FF759195445

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: ccc1f16d2b9fc2463dee01d2f619e68b1c413d3b13c2f6d01cda35fd49cc1089
Instruction ID: 50dfd1ca66cd739b08a39fcc777d92434ce0ef26da9e12079a56ca5fefc26dd0
Opcode Fuzzy Hash: ccc1f16d2b9fc2463dee01d2f619e68b1c413d3b13c2f6d01cda35fd49cc1089
Instruction Fuzzy Hash: 94018F20B08A5185FB84AF56B4005AAE372EF89BD0F9C8036EE4E13B65CF3CE5458790

Function 00007FF759198B08 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF759198D57
RaiseException.KERNEL32 ref: 00007FF759198D68

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a218957482b48b590648b3e16ace9b7ac7afc45119c2de734ba3a03728b764a2
Instruction ID: e55bf1f05fa9d18a3c3c5aeba0a04d765e6b710c3064ef56101c14f68c2f6224
Opcode Fuzzy Hash: a218957482b48b590648b3e16ace9b7ac7afc45119c2de734ba3a03728b764a2
Instruction Fuzzy Hash: 8DB15873600B998BEB55CF29D846368BBF1F744B48F588862DA6E837A8CF39D451C710

Function 00007FF7591650D0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32(?,?,?,?,?,?,?,?,2581848AAB84B8DF,00007FF7591650A8), ref: 00007FF759165128
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,2581848AAB84B8DF,00007FF7591650A8), ref: 00007FF7591651BA

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 52960f018f6b1f12d67629b669ec63dfa0ea14dc44592252fcec820f30678a9d
Instruction ID: 58a420a943c613bda95a79795f314479eb7580994186f4f492cb19857316eec8
Opcode Fuzzy Hash: 52960f018f6b1f12d67629b669ec63dfa0ea14dc44592252fcec820f30678a9d
Instruction Fuzzy Hash: 0B415932A18B90CAE7209F74E4403AD77B4F75878CF484239EA8D06E8ADF79E564C754

Function 00007FF7591BFB20 Relevance: 3.0, Strings: 2, Instructions: 492COMMON

Download Yara Rule

Strings

rel, xrefs: 00007FF7591BFDE4
abs, xrefs: 00007FF7591BFDD4

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID: abs$rel
API String ID: 0-1867029159
Opcode ID: a473d4a40322626fd3db14bdbe02dfedb8dc11f491bf41f379a2da7ce227cca6
Instruction ID: 76bb4b1ec9df63c41e406327aab8942f0d7128864c330b66a9867c2537d4f15d
Opcode Fuzzy Hash: a473d4a40322626fd3db14bdbe02dfedb8dc11f491bf41f379a2da7ce227cca6
Instruction Fuzzy Hash: 8F121962F186668AFF60AE79D4403BDA3B2EB09748F894035DE4957785CF38D9418B60

Function 00007FF75919BE30 Relevance: 2.9, Strings: 2, Instructions: 358COMMONLIBRARYCODE

Download Yara Rule

Strings

am/pm, xrefs: 00007FF75919C0DF
a/p, xrefs: 00007FF75919C14A

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID: a/p$am/pm
API String ID: 0-3206640213
Opcode ID: 9ef95d5893d21d87e11e817d9d394996ef015b18a9a1a9919d769f0bf271b381
Instruction ID: 5efa47dc9b927b1085defeb1727009f41ca711fc69f34768c352b234f3ee2d26
Opcode Fuzzy Hash: 9ef95d5893d21d87e11e817d9d394996ef015b18a9a1a9919d769f0bf271b381
Instruction Fuzzy Hash: 83E1B032E0866285EF64AF65A5545BDA3B6FF11784FDC4132EA8E07684DF3CEA41D320

Function 00007FF75915FE70 Relevance: 1.7, APIs: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75916018B

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 341a44eef4bf027e22ac0649b1b2f74ac2dd1c03a59da04e6e5f69c7db6cd1f1
Instruction ID: 60fd4d4c67ddf061341804bf64c5be19ba2b81482178b233b9e04c4e21f335af
Opcode Fuzzy Hash: 341a44eef4bf027e22ac0649b1b2f74ac2dd1c03a59da04e6e5f69c7db6cd1f1
Instruction Fuzzy Hash: 03A17B22A19BA989EB00CF7AE4803AC7770F759748F988526DF8D57B55DF38D191C320

Function 00007FF75915FB50 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75915FE64

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c3307284c6efabcbe71df6c566b1e1b71424ed86a7ad0a1535a7446ffe1797c8
Instruction ID: 8b703078c4e1e1cbb75792710f982dbde6dd7b4a857f51bd38ea1648379d07a0
Opcode Fuzzy Hash: c3307284c6efabcbe71df6c566b1e1b71424ed86a7ad0a1535a7446ffe1797c8
Instruction Fuzzy Hash: 2BA17B22A19BA999EF00CF69E4803ACB770F759B48F988426CF8D57755DF38D191C360

Function 00007FF75915F200 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75915F4F8

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 399eb5a60e8f0e2e4bce4a5e7932d4aa62690c71363c3b1c634334a9f2a8f2df
Instruction ID: e1b43052e59990418cb17e982632a5a2d5ab714282923807def1b0cb9b673e68
Opcode Fuzzy Hash: 399eb5a60e8f0e2e4bce4a5e7932d4aa62690c71363c3b1c634334a9f2a8f2df
Instruction Fuzzy Hash: 29A18962B19BA999EF018FAAE4803ACA770F758748F984426CF8D57795DF38D491C320

Function 00007FF7591601A0 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759160498

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d750437385fe57c59689f1d4f4a35045e2006ce76b3b28ef975e9fc8603815c0
Instruction ID: 3d7873c7a9f67a8f961c6b5c461a89a93e0c5b016f35bba913b0362802892c6e
Opcode Fuzzy Hash: d750437385fe57c59689f1d4f4a35045e2006ce76b3b28ef975e9fc8603815c0
Instruction Fuzzy Hash: 1CA17C22B19BA989EB10CF7AE4803ACA770F755748F98442ACF8D53B55DF38D051C310

Function 00007FF7591620BE Relevance: 1.5, APIs: 1, Instructions: 34comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF7591620FD
CoSetProxyBlanket.OLE32 ref: 00007FF759162152
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916233A

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: BlanketCreateInstanceProxy_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2651345351-0
Opcode ID: 7f2d3f72266a1ad56397fe19ef10ec5738d5c2edbc89f2b51367f2cc5b199f66
Instruction ID: b7a0d247a1fafd3f5b423c6f0431aa57b2593ee605a3b5721f13e880badbcff4
Opcode Fuzzy Hash: 7f2d3f72266a1ad56397fe19ef10ec5738d5c2edbc89f2b51367f2cc5b199f66
Instruction Fuzzy Hash: A9018F22F09A958AFB21EF60E4013ADA375BB48758F884536CF4E47A54DF38D485C350

Function 00007FF759194ED8 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 00007FF759194F27

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: ed705c37d69ef8013e8692d4cdd39cd770c57f58848f00780f6b4190c1d9d426
Instruction ID: c7a5ddfa92ebc1aa7d2c88cdbe842a712a3eaa3037a40491a4b6d240c89399a8
Opcode Fuzzy Hash: ed705c37d69ef8013e8692d4cdd39cd770c57f58848f00780f6b4190c1d9d426
Instruction Fuzzy Hash: DEF0FB72A04B8182E644AF19F8905A9A3B2EB98B80F986035DA4D87365CF2CD451C610

Function 00007FF75918AC90 Relevance: 1.5, APIs: 1, Instructions: 28timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF75918ACA4

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 059300715565b079a0da65c434dbffadc9a810c62e898f297631b766a843873b
Instruction ID: e7695d33ce5d045fade828e661f78929c7ca8f894a8851d6e48b82a88828b292
Opcode Fuzzy Hash: 059300715565b079a0da65c434dbffadc9a810c62e898f297631b766a843873b
Instruction Fuzzy Hash: 5BF0E2E2B29A8803EE249B19E4143A49291AF5CBF0E449331EE3E0E7C9EF1CD1508700

Function 00007FF7590F5DC0 Relevance: 1.0, Instructions: 961COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fec21f9ddb32210f6b5e969e071971b159482b6e2fd4f4b72927dbf668d3f10
Instruction ID: e877630458cc7252150f2bc5815d4403c93dbe0d3570fca23dbdd8d287dd070b
Opcode Fuzzy Hash: 5fec21f9ddb32210f6b5e969e071971b159482b6e2fd4f4b72927dbf668d3f10
Instruction Fuzzy Hash: 9FC2B272525FC889D7B18F39EC812DD73A8F75878CF109625EB8C5AB19EF3482589348

Function 00007FF7591DE4B0 Relevance: .6, Instructions: 579COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d4d767bbbaaf6fc642392a77769fc2c7124bc08782bf1337f65d91400a68ab
Instruction ID: 5be65fdcfe3c7a114c587ae8a7ad55c5b1d80859337271ee8b6ce1c256fb8a3e
Opcode Fuzzy Hash: b7d4d767bbbaaf6fc642392a77769fc2c7124bc08782bf1337f65d91400a68ab
Instruction Fuzzy Hash: FD526121D29F66D9F693AF35B811535E334FF563C1F89A733E80E6A650DF2CA4428620

Function 00007FF7591492D0 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47d2fc46064dab5907b35485465ac6e09d969a0ee3f7e69edd6212c471c0128
Instruction ID: ee16cd5fa99619e674cd437d44dd9457b3d7d3cfa73bf6686c1d7acff1921737
Opcode Fuzzy Hash: f47d2fc46064dab5907b35485465ac6e09d969a0ee3f7e69edd6212c471c0128
Instruction Fuzzy Hash: 73C1E363B286A587EB16CF22E544569B762F7D8FD0B89D131DA4E07B84DB3CD802CB00

Function 00007FF759191CB8 Relevance: .4, Instructions: 356COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: fc738250f0c9c309bdd893c04d7771f87c9341789a39d89ec59cf125030b0b93
Instruction ID: 9fe6de2f7917a5d7aac766cb9b329903f1c1b59a68c84c6d75dd47dcdf901420
Opcode Fuzzy Hash: fc738250f0c9c309bdd893c04d7771f87c9341789a39d89ec59cf125030b0b93
Instruction Fuzzy Hash: 36E1D326B086A245FF64AF61A5103BAA3B2FF84B88F884431DE4E476D5DF3CE445C320

Function 00007FF759162CB0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction ID: 3a270257f6d42081221bbb9737dfb24dcd3a95f345ac3b1dc22cd1e2c33ac4db
Opcode Fuzzy Hash: 34fb1097c6f2363caac24c1e5b45ae24c1a6ca50cb597d280e611698873f3a91
Instruction Fuzzy Hash: 75C1D3B3A146948BE355CF2DD40195D7BE0F398B84F40A629EB56C3B01E778E9A5CF80

Function 00007FF7591849B4 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58993cc49f4dd608ba7a820bbbd73e261f21bf312b089c0bcad54f873d9ee38f
Instruction ID: 57a1bbaf8a8702c43cbb7dab8290b678d54b09ac484e1651ca544746fb0108f0
Opcode Fuzzy Hash: 58993cc49f4dd608ba7a820bbbd73e261f21bf312b089c0bcad54f873d9ee38f
Instruction Fuzzy Hash: 78916722B1826646FF64AE25B0403B9E6A4BF50788F8D2239DD2E477C4DF3CE405E725

Function 00007FF7590F8000 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf60a5878d10fb45bb922aa4434284bfb4a8850ce500248e9bf54e3d3a20baed
Instruction ID: c8643e2f4eb4bbe1ae4716f5a09f4deb6246c41edba82068a87adb335a9d5fa3
Opcode Fuzzy Hash: bf60a5878d10fb45bb922aa4434284bfb4a8850ce500248e9bf54e3d3a20baed
Instruction Fuzzy Hash: A6B1F532919FC88AD7108F69E8802ADB7B5F7997A8F541325EACC23B59EF78D154C700

Function 00007FF75913DDA0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197750e4aaad263fb16452bdc9eff378dcd9ed9655da37c4e9a39dd39b5568c7
Instruction ID: c1e4a665fc9465acc633bb282da4c4f13417908eab6f27bc69275d0056209a08
Opcode Fuzzy Hash: 197750e4aaad263fb16452bdc9eff378dcd9ed9655da37c4e9a39dd39b5568c7
Instruction Fuzzy Hash: D061E626B14B8942DE10CF19E1451A9A375E7697D4F989231EB9D47B48EF7CE180C340

Function 00007FF7591E1BCC Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 96dee636877c4981823ff604cc05051f0ce0167f6762f4337eb515c1ee7efdad
Instruction ID: 4c2103d0c167e6d8b5691ae90d21b44fc0cd0515adb827c3f4e2e4256e4fa482
Opcode Fuzzy Hash: 96dee636877c4981823ff604cc05051f0ce0167f6762f4337eb515c1ee7efdad
Instruction Fuzzy Hash: CD61EB22F082B143FF65AD28A554679E9F1BF41360F9C063DE62D8B6C5DF2DD8408720

Function 00007FF7591630F0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7712bce75c303a6c128dfa0d45a2675bbe9045de200c46ed45cf77d95598a9a8
Instruction ID: 9b3dd04791fdaf4039c7bf41c363684b865c022db6a5ef9dcb62d75043bf4102
Opcode Fuzzy Hash: 7712bce75c303a6c128dfa0d45a2675bbe9045de200c46ed45cf77d95598a9a8
Instruction Fuzzy Hash: 0161C02321E2C48FD30DDF7C589106D7F61D2A7908388469DEA85EBB4BC514C91ACBA6

Function 00007FF759188ABC Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction ID: 4ddf1b25b5696cf3f9f1334172ac05e82d4911efd3fc933bfed59aa46906e3cd
Opcode Fuzzy Hash: ac8362b94cbf271fd23ce0d6965fdbbec26e6817efc2dd1af2fcdc0b4ee58872
Instruction Fuzzy Hash: 6C51C072A18A6186FB249F28E044278F7B4EB84B98FA84171CE5D07794CF3EE843D751

Function 00007FF759188CC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction ID: a35554efd79e9c9564a7627c0acd9e59538efff683916a107984d6706b1499be
Opcode Fuzzy Hash: 45278502b4de115ed76afef2690a2838d0b28876f14c66dd069eb4612fa83dd3
Instruction Fuzzy Hash: C9518236A1866186FB249F29E040328F7B0EB54B58FA84171CE5D177A4CF3EE843D751

Function 00007FF759188EC4 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction ID: 58075058e8aa461f72d31f993da771795c1aa8b19cf6b2e5ae606e8faab48e9b
Opcode Fuzzy Hash: c9c3f90e6787dc6e65e60abd648d80575bcfa0207306300bab00d1ff848a11e7
Instruction Fuzzy Hash: 95519036A28A6186FB249F29E040238F7B1EB44B58F684171DE4D17794CF3EE843E791

Function 00007FF7591A32E0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 8c08d7308113fb21a23596271e587e6057e87f3d6b82481ecb8894e85f4e57f2
Instruction ID: 60b1bb17456b5672c562768ac06c2ddc0856509f86b621166e8416c1bb836fd9
Opcode Fuzzy Hash: 8c08d7308113fb21a23596271e587e6057e87f3d6b82481ecb8894e85f4e57f2
Instruction Fuzzy Hash: 3F41E472718A6582FF44DF6AE954169B3A1FB48FC4B99A032EE0D87B58DF3CD4428340

Function 00007FF75918F268 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3cb59ec0bf7899867bf851bf667cf51092c67ae8703a3e64bec9bc61aabe119
Instruction ID: e1c29a26203506dedd79d1e631130eb8b6897e80df02dc509e25106f30085b88
Opcode Fuzzy Hash: d3cb59ec0bf7899867bf851bf667cf51092c67ae8703a3e64bec9bc61aabe119
Instruction Fuzzy Hash: E9314826B1C13282FEA5BD29B555679D172AF82340EEC8031D80D01B9B8F2EF445F6A3

Function 00007FF759161C30 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF759161C86
Process32FirstW.KERNEL32 ref: 00007FF759161CCA
Process32NextW.KERNEL32 ref: 00007FF759161CDF
OpenProcess.KERNEL32 ref: 00007FF759161D1B
OpenProcessToken.ADVAPI32 ref: 00007FF759161D42
GetTokenInformation.ADVAPI32 ref: 00007FF759161D6E
GetLastError.KERNEL32 ref: 00007FF759161D7C
GetTokenInformation.ADVAPI32 ref: 00007FF759161DBC
ConvertSidToStringSidA.ADVAPI32 ref: 00007FF759161DD3
CloseHandle.KERNEL32 ref: 00007FF759161E46
CloseHandle.KERNEL32 ref: 00007FF759161E51
CloseHandle.KERNEL32 ref: 00007FF759161EB6
Process32NextW.KERNEL32 ref: 00007FF759161EC3
CloseHandle.KERNEL32 ref: 00007FF759161EE9
CloseHandle.KERNEL32 ref: 00007FF759161EF2
CloseHandle.KERNEL32 ref: 00007FF759161F07

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: CloseHandle$Process32Token$InformationNextOpenProcess$ConvertCreateErrorFirstLastSnapshotStringToolhelp32
String ID:
API String ID: 3925315391-0
Opcode ID: f42cf85e0bce5153215c9d7babbbe699e3c4e8a243701d2dfd245effa3a2a78e
Instruction ID: 9d848b89357f70e1e527061b526221ff4b5e7834389cefbce65b22befc4c9fa3
Opcode Fuzzy Hash: f42cf85e0bce5153215c9d7babbbe699e3c4e8a243701d2dfd245effa3a2a78e
Instruction Fuzzy Hash: F6814A32A19B9182FF50AF25F94426AE3B5FB88B94F844135EE8D47B58DF7CE4058B10

Function 00007FF759191208 Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF759191217
FlsGetValue.KERNEL32 ref: 00007FF75919122C
FlsSetValue.KERNEL32 ref: 00007FF75919124D
FlsSetValue.KERNEL32 ref: 00007FF75919127A
FlsSetValue.KERNEL32 ref: 00007FF75919128B
FlsSetValue.KERNEL32 ref: 00007FF75919129C
SetLastError.KERNEL32 ref: 00007FF7591912B7
FlsGetValue.KERNEL32 ref: 00007FF7591912ED
FlsSetValue.KERNEL32 ref: 00007FF75919130C

Part of subcall function 00007FF759194E28: HeapAlloc.KERNEL32(?,?,00000000,00007FF7591913E2,?,?,00009576C16D8760,00007FF759188599,?,?,?,?,00007FF759194C7A,?,?,00000000), ref: 00007FF759194E7D

FlsSetValue.KERNEL32 ref: 00007FF759191334

Part of subcall function 00007FF7591947C0: RtlFreeHeap.NTDLL(?,?,FFFFFFFFF0B8480A,00007FF75919F1B2,?,?,?,00007FF75919F52F,?,?,00000000,00007FF75919D281,?,?,00007FF7591A366E,00007FF75919D1B3), ref: 00007FF7591947D6
Part of subcall function 00007FF7591947C0: GetLastError.KERNEL32(?,?,FFFFFFFFF0B8480A,00007FF75919F1B2,?,?,?,00007FF75919F52F,?,?,00000000,00007FF75919D281,?,?,00007FF7591A366E,00007FF75919D1B3), ref: 00007FF7591947E0

FlsSetValue.KERNEL32 ref: 00007FF759191345
FlsSetValue.KERNEL32 ref: 00007FF759191356

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 7c967122ad4d7ecad4dbaaf56d21964e2454bb0f298830798979b60159b840d5
Instruction ID: 1e44957baca575f31a7c89c0cdf66d916a1ec5a75c695667b7177ee2373e621b
Opcode Fuzzy Hash: 7c967122ad4d7ecad4dbaaf56d21964e2454bb0f298830798979b60159b840d5
Instruction Fuzzy Hash: 9C412920B0C22242FE987F617A51179E2B35F457B4FDC1734E93E5AAC2DF2CB6424220

Function 00007FF759120420 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 281COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 00007FF75912047F

Part of subcall function 00007FF7591DB290: AreFileApisANSI.KERNEL32(?,?,?,?,00007FF75913F0B6,?,?,00000000,00000000,?,00000000,?,00007FF75912855D), ref: 00007FF7591DB2A2

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759120692
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759120698
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF759120727
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912074D
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF7591207E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591207ED

Strings

: ", xrefs: 00007FF75912053A
", ", xrefs: 00007FF75912056D

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy$ApisFile__std_fs_code_page
String ID: ", "$: "
API String ID: 1991941009-747220369
Opcode ID: 0f0a78cabc45884e6da76cca535291b853cf26a0a925827afb0c860ac207dd90
Instruction ID: 987ed5f022210bbe7c496c7d1b837ddc9240087fbf6f1b60daf0ba4c93028a06
Opcode Fuzzy Hash: 0f0a78cabc45884e6da76cca535291b853cf26a0a925827afb0c860ac207dd90
Instruction Fuzzy Hash: B8B1BC62B08B5486FF00EF75E0443ACA371EB45B88F988531EA5E07B99DF39D595C390

Function 00007FF759139230 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 261COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7591392A0
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7591392E8
_Getcoll.LIBCPMT ref: 00007FF75913931C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75913941B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759139486
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591394F9

Strings

bad locale name, xrefs: 00007FF759139421

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1677125601-1405518554
Opcode ID: 88079e8517fec9cfcc7c8ac3f5039ea7a47a817c4aad07439b917c5b4a5cbb2b
Instruction ID: 7aa35c66d1219dac69f951ce76bda57da8b28024dfcc9d622a3786e0c7b9e910
Opcode Fuzzy Hash: 88079e8517fec9cfcc7c8ac3f5039ea7a47a817c4aad07439b917c5b4a5cbb2b
Instruction Fuzzy Hash: 9BA1CE62B0AB458AFF15AFB5E4403ADB3B1EF44B88F884535DA4D1BA89DF38D4518390

Function 00007FF759167B00 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF759167B7D
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF759167BC5
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759167D41
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759167D54
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759167D5A

Strings

false, xrefs: 00007FF759167C4D
bad locale name, xrefs: 00007FF759167D47
true, xrefs: 00007FF759167C7C

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: cd099738ed1609ff69ed68634f856e852bd492813bf82195bd31ad29d5933a25
Instruction ID: 44824841a4620cbdc54616103ffd834e08083f0b9ad7a4e71ad47d4964e6ade0
Opcode Fuzzy Hash: cd099738ed1609ff69ed68634f856e852bd492813bf82195bd31ad29d5933a25
Instruction Fuzzy Hash: 7A713C22B09B518AFB11EF70E4502BDB3B6EF84748F8C4539DA4C27A99DF38A411D365

Function 00007FF759157FD1 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 273COMMON

Download Yara Rule

Strings

; last read: ', xrefs: 00007FF75915819C
; expected , xrefs: 00007FF759158427
while parsing , xrefs: 00007FF759158018

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID: ; expected $; last read: '$while parsing
API String ID: 0-2554043419
Opcode ID: 5c7a5fa41691b6bd0e243fa2ad2de8c47fca30c2961104285f8f1e4a3ef8a2f0
Instruction ID: 9a148a058edc8527e50d9bcde8beb7d968f361da8c936f78d19373c0ae7091c5
Opcode Fuzzy Hash: 5c7a5fa41691b6bd0e243fa2ad2de8c47fca30c2961104285f8f1e4a3ef8a2f0
Instruction Fuzzy Hash: 64C1B362F146A199FF00EFA4E4403ED6B72EB007A8F994235DE1D6BAC9DF789485D310

Function 00007FF759194F54 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,00007FF7591955FE,?,?,00000030,00007FF75919CB54), ref: 00007FF7591950D0
GetProcAddress.KERNEL32(?,00000000,00007FF7591955FE,?,?,00000030,00007FF75919CB54), ref: 00007FF7591950DC

Strings

ext-ms-, xrefs: 00007FF75919502D
api-ms-, xrefs: 00007FF75919501A

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 719561378f0d74617f1bcdbfcfc11508aac42a575313cbdf1355d5b59e53c671
Instruction ID: 0af3be8456e6277f958cca9fb9abca8433256d2d3f8957d8c8df4dff60225db3
Opcode Fuzzy Hash: 719561378f0d74617f1bcdbfcfc11508aac42a575313cbdf1355d5b59e53c671
Instruction Fuzzy Hash: D441D322B1966281FE55EF16B80057AA3B2BF4ABA0F8D4535DD0D97794EF3CF4058360

Function 00007FF759168180 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 00007FF7591681EB
InternetOpenUrlA.WININET ref: 00007FF759168220
InternetReadFile.WININET ref: 00007FF759168241
InternetReadFile.WININET ref: 00007FF75916827F
InternetCloseHandle.WININET ref: 00007FF75916828C
InternetCloseHandle.WININET ref: 00007FF759168295

Strings

File Downloader, xrefs: 00007FF7591681E4

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 91e744b22f357f91b51b56f9f413c7a71866174e8c47e92bf1781ef31d06db3a
Instruction ID: 04e7c25869ecc791f8ec71da27bd3d46f345318cb70d426db3d5efd680a9f8ea
Opcode Fuzzy Hash: 91e744b22f357f91b51b56f9f413c7a71866174e8c47e92bf1781ef31d06db3a
Instruction Fuzzy Hash: 5C316E32A19B8186EB509F11F8506AAB374FB88BC4F884035EE8D03B58DF7CE455CB10

Function 00007FF7591604A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF75916067F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759160704
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916070A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759160710
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759160716

Strings

invalid_iterator, xrefs: 00007FF759160514

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: invalid_iterator
API String ID: 1944019136-2508626007
Opcode ID: c70e24125cf4320abfa5527c06e714ac6e0f4bdbca4e5e6bd150f12c00010374
Instruction ID: 4af7447663318c6052a326982d7653ebf692f23f8d835205786f0366b9818881
Opcode Fuzzy Hash: c70e24125cf4320abfa5527c06e714ac6e0f4bdbca4e5e6bd150f12c00010374
Instruction Fuzzy Hash: 3971C263F19B8184FF00EF75E4403ACA371EB49798F989231EA5C16AD9EF38A585C350

Function 00007FF75915DC80 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF75915DE63
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75915DEED
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75915DEF3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75915DEF9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75915DEFF

Strings

out_of_range, xrefs: 00007FF75915DCF2

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: out_of_range
API String ID: 1944019136-3053435996
Opcode ID: d136a6ab93a13f93a22ecb7c1c109add31bd963ec3171c0f149cb2b9c5f1fdd7
Instruction ID: 87d586a9fb0b5c90b984327c7b07bfe9bb88cf14ff9b82af58a9026225da48fc
Opcode Fuzzy Hash: d136a6ab93a13f93a22ecb7c1c109add31bd963ec3171c0f149cb2b9c5f1fdd7
Instruction Fuzzy Hash: E171B462F18B8198FF00EF78E4403ACA371EB553A8F859331EA5C16AD9EF789585C350

Function 00007FF759138260 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF759138443
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591384CD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591384D3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591384D9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591384DF

Strings

other_error, xrefs: 00007FF7591382D2

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: other_error
API String ID: 1944019136-896093151
Opcode ID: acba0af718f1fb9f5a73f58b4407647d518a2a0c18cf1a1e93d152ec8f62f7af
Instruction ID: 29ab4dd4ba90e9208a514df779d120e3f1858e2b9edda301fc1e82ea12505a01
Opcode Fuzzy Hash: acba0af718f1fb9f5a73f58b4407647d518a2a0c18cf1a1e93d152ec8f62f7af
Instruction Fuzzy Hash: E971A063F18B8589FB00EF74E4403ADA371AB553A8F949231EA6C16AD9EF7CD585C310

Function 00007FF759137460 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF75913763F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591376C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591376CA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591376D0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591376D6

Strings

type_error, xrefs: 00007FF7591374D4

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: type_error
API String ID: 1944019136-1406221190
Opcode ID: 7c623e4d7ab442162d3450008bd532494879938e6a68c4cf1714a44e76a081a6
Instruction ID: 71de92e9c39bf843c837dcce9f9d458320d9654689d63f3c95b189abe43811cf
Opcode Fuzzy Hash: 7c623e4d7ab442162d3450008bd532494879938e6a68c4cf1714a44e76a081a6
Instruction Fuzzy Hash: B271B363F19B8589FF00EF74E4503ACA371AB55398F989231EA5C16AD9EF38A185C350

Function 00007FF75914CAB0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75914CC52
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75914CC58
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF75914CC90
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF75914CC9D

Strings

at line , xrefs: 00007FF75914CB3A
, column , xrefs: 00007FF75914CB68

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: __std_exception_destroy_invalid_parameter_noinfo_noreturn
String ID: at line $, column
API String ID: 729085983-191570568
Opcode ID: 3f780ef7e5359a42c46859976d2eda710d51c6f5304ee1e9230b02aa1cf7dc94
Instruction ID: cc1f4dc8f0cabb07a3df523698809211ddeabad253e374f9c61b68db95d957f4
Opcode Fuzzy Hash: 3f780ef7e5359a42c46859976d2eda710d51c6f5304ee1e9230b02aa1cf7dc94
Instruction Fuzzy Hash: 9251B372E0879541EA10AF19F14026EA771FB89BD4F984231EBAC07B96DF7CD5828340

Function 00007FF7591A401C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7591A404D
GetLastError.KERNEL32 ref: 00007FF7591A4059
CloseHandle.KERNEL32 ref: 00007FF7591A4071
CreateFileW.KERNEL32 ref: 00007FF7591A409C
WriteConsoleW.KERNEL32 ref: 00007FF7591A40BB

Strings

CONOUT$, xrefs: 00007FF7591A407D

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: d64a5614ff09383aec324552889b53812a6c5a93abf77eb905263844d90bf464
Instruction ID: c98a8513f7d37b470b96ce9f2691879b1f05bf7693f1bc19679b01ad7c08608c
Opcode Fuzzy Hash: d64a5614ff09383aec324552889b53812a6c5a93abf77eb905263844d90bf464
Instruction Fuzzy Hash: 26118121A18B4186F790AF12F854339F2B0FB98BE4F881235EA5D87794CF3CE8148754

Function 00007FF7591DD110 Relevance: 9.1, APIs: 6, Instructions: 94threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7591DD161
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF7591DD180
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF7591DD1A2
sys_get_time.LIBCPMT ref: 00007FF7591DD1BD
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF7591DD1E3
TryAcquireSRWLockExclusive.KERNEL32 ref: 00007FF7591DD1FB

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThreadsys_get_time
String ID:
API String ID: 184115430-0
Opcode ID: dcaa0c5ec967c3866615ac309e3086bf37bc4396709c5386fc2d1e26bec89594
Instruction ID: 2c3e7ae247d56e70f73bdb8d32b2fac90a3643ede000eeea8bb17fbd4278fa70
Opcode Fuzzy Hash: dcaa0c5ec967c3866615ac309e3086bf37bc4396709c5386fc2d1e26bec89594
Instruction Fuzzy Hash: F3412D7AA0876686EFA4AF14F440339B370FB55B84F884035DA5D42A98DF3CE955CB10

Function 00007FF7591B9020 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591B924E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7591B925A

Strings

tter, xrefs: 00007FF7591B93D6
$, xrefs: 00007FF7591B93AF
/, xrefs: 00007FF7591B93B8

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: $$/$tter
API String ID: 73155330-4034128088
Opcode ID: d6074e1e23a7ea458cbdc3411ce5e52139f6dd3b86624e2aba97a4002dc31c6c
Instruction ID: cfa8fbc078ada2d5ee92621bf4604a66f96b8d750991a7f23c6341865b586646
Opcode Fuzzy Hash: d6074e1e23a7ea458cbdc3411ce5e52139f6dd3b86624e2aba97a4002dc31c6c
Instruction Fuzzy Hash: 6FB1A122A18BA182EB14EF24F44036DB7B2FB85B94F984235EA9D43B95DF3CD591C350

Function 00007FF759127180 Relevance: 7.8, APIs: 5, Instructions: 312COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759127612
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759127618
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912761E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759127624
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75912762A

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: a146be0718f4bd72be71e4d597e876e6d7614a783eeef39a4546d8c2212f8fa9
Instruction ID: 3a3c607a404df7cc09da3f2e8afc4bed266f7e2b0c8d6c87d9b0b422f9fa4e75
Opcode Fuzzy Hash: a146be0718f4bd72be71e4d597e876e6d7614a783eeef39a4546d8c2212f8fa9
Instruction Fuzzy Hash: 41D1BF62B087A185FE10AF66F4402AEA771EB457E8F981231EE5D17BD9DF79E4808310

Function 00007FF7591781C0 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF7591781E0
FreeEnvironmentStringsW.KERNEL32 ref: 00007FF7591782DB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759178305
RtlInitUnicodeString.NTDLL ref: 00007FF75917834E
RtlInitUnicodeString.NTDLL ref: 00007FF75917835B

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1868271193-0
Opcode ID: d1cfb9c678f6b3bfd6e15e9b3720f0f3282dc3bc451fd851657b04b91d9ff4b9
Instruction ID: a4e51887de29797669f2ebc135fb148e19597d85105b6fee72d2242a6b587502
Opcode Fuzzy Hash: d1cfb9c678f6b3bfd6e15e9b3720f0f3282dc3bc451fd851657b04b91d9ff4b9
Instruction Fuzzy Hash: F8518C22A08B9182EB10AF15F48036DB370FB98B94F989221EB9D03B95DF7CE5D1C714

Function 00007FF759172FF0 Relevance: 7.6, APIs: 5, Instructions: 106COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF759173022
GetWindowRect.USER32 ref: 00007FF759173033
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591731AC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591731B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7591731B8

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Window$DesktopRect
String ID:
API String ID: 1991322523-0
Opcode ID: fcd7ca55d02a325fb34b73fcd1eeca359179940b2b54e1d205aed709906dea99
Instruction ID: 1d82c359324bcfd382e0233935155460b3c60d7572f60e9f9b6e918a6daf2a67
Opcode Fuzzy Hash: fcd7ca55d02a325fb34b73fcd1eeca359179940b2b54e1d205aed709906dea99
Instruction Fuzzy Hash: 0B418262A1C78641FE20AF28F44536EE361EB857A4F944231EAAD46BD9DF3CE4818650

Function 00007FF759191448 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF759183867,?,?,00000000,00007FF759183B02,?,?,?,?,?,00007FF759183A8E), ref: 00007FF759191467
FlsSetValue.KERNEL32(?,?,?,00007FF759183867,?,?,00000000,00007FF759183B02,?,?,?,?,?,00007FF759183A8E), ref: 00007FF759191486
FlsSetValue.KERNEL32(?,?,?,00007FF759183867,?,?,00000000,00007FF759183B02,?,?,?,?,?,00007FF759183A8E), ref: 00007FF7591914AE
FlsSetValue.KERNEL32(?,?,?,00007FF759183867,?,?,00000000,00007FF759183B02,?,?,?,?,?,00007FF759183A8E), ref: 00007FF7591914BF
FlsSetValue.KERNEL32(?,?,?,00007FF759183867,?,?,00000000,00007FF759183B02,?,?,?,?,?,00007FF759183A8E), ref: 00007FF7591914D0

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1676eb1c086681754cdec43adc27aa7b6a61153bc21780dab2384285e321c083
Instruction ID: 2441baf24181a47fd3dc2678456bd7e36d89fc638dad58850c883991f3c7466b
Opcode Fuzzy Hash: 1676eb1c086681754cdec43adc27aa7b6a61153bc21780dab2384285e321c083
Instruction Fuzzy Hash: 5B114720F0C26241FE59BF257A51239E2636F4A7A0ECC5334E82D1B7C6DF2CE5428620

Function 00007FF75917EEE0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 300COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75917F0BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75917F0C7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF75917F2C4

Strings

H, xrefs: 00007FF75917F2D0

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: Concurrency::cancel_current_task$_invalid_parameter_noinfo_noreturn
String ID: H
API String ID: 4131450254-37590417
Opcode ID: 8d15d4be343cfcc83d1d693c0dcb39653d00ee63b835e551ac0eecf3c45be02d
Instruction ID: 5c52ce1eff8b285853041b8a2eaf02fc19e0136bf0b448256e846ee9237f61c3
Opcode Fuzzy Hash: 8d15d4be343cfcc83d1d693c0dcb39653d00ee63b835e551ac0eecf3c45be02d
Instruction Fuzzy Hash: D7B1D122B15B9682EE10EF65B44066AA3A4FB48BE4F984735EAAD077C4DF38D591C300

Function 00007FF7591E0CE8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7591E0FC7

Part of subcall function 00007FF7591A3BFC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7591A3C19

Strings

UTF-8, xrefs: 00007FF7591E0F46
UTF-16LEUNICODE, xrefs: 00007FF7591E0F65
ccs, xrefs: 00007FF7591E0F02

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 035adfd8f30b7d3758a11a9300093ffa4a34d8b58ad662a0b6622189a8e9a0c0
Instruction ID: 1c6f1fac78307a043f08ec2f929d07bc4fb80ba42651784283e90176a8a51796
Opcode Fuzzy Hash: 035adfd8f30b7d3758a11a9300093ffa4a34d8b58ad662a0b6622189a8e9a0c0
Instruction Fuzzy Hash: 9481C032E0C62287FF746E35A250278AEB0AB10B44FDD803DEA4A57295CB3DF9419761

Function 00007FF75911F1A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF75911F20F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF75911F257
_Getctype.LIBCPMT ref: 00007FF75911F295

Strings

bad locale name, xrefs: 00007FF75911F34E

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 5f073343040d0bdc564ba2085f01554342092d3c436d0d1b1f3e00217c640a7c
Instruction ID: 078125d4a32d27d4e01d54524981c65fb510087a34845b0931675fe6ad16309d
Opcode Fuzzy Hash: 5f073343040d0bdc564ba2085f01554342092d3c436d0d1b1f3e00217c640a7c
Instruction Fuzzy Hash: 5D518822B09B019AFF10EF60E4902BCB3B5EF44748F884439DE4D26A99DF38D515D3A4

Function 00007FF75916DB46 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916DC67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916DC6D

Part of subcall function 00007FF7591A85D8: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,-728320C5349B87FA,00007FF7591DC402), ref: 00007FF7591A8628
Part of subcall function 00007FF7591A85D8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,-728320C5349B87FA,00007FF7591DC402), ref: 00007FF7591A8669

Strings

ios_base::badbit set, xrefs: 00007FF75916DCA5, 00007FF75916DCDC, 00007FF75916DD1A
exists, xrefs: 00007FF75916DC83

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ExceptionFileHeaderRaise
String ID: exists$ios_base::badbit set
API String ID: 240014264-2074760687
Opcode ID: 893500fba6649c79879436cc3c2455fd9b9589992b8a15c20b442d189fce4a5f
Instruction ID: 62e504796adb32aa0482d1b784d32c1992a46763c21f28c92b3f8697f3cf6102
Opcode Fuzzy Hash: 893500fba6649c79879436cc3c2455fd9b9589992b8a15c20b442d189fce4a5f
Instruction Fuzzy Hash: 4C410972A19BC695EE60EF14F4842EAB3B1FB84744F848132DA8D43AA9DF3CD545CB50

Function 00007FF7591DB240 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF7591DB92A), ref: 00007FF7591DB256
GetProcAddress.KERNEL32(?,?,?,00007FF7591DB92A), ref: 00007FF7591DB266

Strings

kernel32.dll, xrefs: 00007FF7591DB24F
GetTempPath2W, xrefs: 00007FF7591DB25C

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 1486a03457541e07cc672fa27f6337fb1d4ca800d066eee7c0edc0d6007ce8ef
Instruction ID: 64e6f8b47451a82b82e698b3ea0b3db01e271c3f8b5825767b1ca47f418a83ac
Opcode Fuzzy Hash: 1486a03457541e07cc672fa27f6337fb1d4ca800d066eee7c0edc0d6007ce8ef
Instruction Fuzzy Hash: BFE0ED21B18A0682FE44AF51F988479A331FF48B81F9C5036C90E07334DF2CE5958B10

Function 00007FF75916AC40 Relevance: 6.4, APIs: 4, Instructions: 370COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916B184
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916B18A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF75916B196
SysFreeString.OLEAUT32 ref: 00007FF75916B1B7

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FreeString
String ID:
API String ID: 1965679434-0
Opcode ID: a0518215b6139a30e2d0b05b40eab4b103e62f06007231baa91a109bccf00a02
Instruction ID: 522c3f5e184f923495e80beec3ca415aff752766c77f81772d32957eb7876960
Opcode Fuzzy Hash: a0518215b6139a30e2d0b05b40eab4b103e62f06007231baa91a109bccf00a02
Instruction Fuzzy Hash: 0BE1C262F18A958AFF00EFA5E0542ECA3B2EB05798F844531DE1D17BCADF38D5458350

Function 00007FF759193AF8 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF759193B77
WriteFile.KERNEL32 ref: 00007FF759193E3F
WriteFile.KERNEL32 ref: 00007FF759193E85
GetLastError.KERNEL32 ref: 00007FF759193F3B

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: fa227f40509e3349170f30eb00e800148d5492ae5e34f4221cfa920054858855
Instruction ID: 0dc1c48c55fb67ef5d9666853d4381b9cf6de9a991857f7030d6b933583add25
Opcode Fuzzy Hash: fa227f40509e3349170f30eb00e800148d5492ae5e34f4221cfa920054858855
Instruction Fuzzy Hash: 74D10432B08A9189EB10DF75E4442ACB7B2FB45B98B884136DE5E97B89DF38D507C350

Function 00007FF7591944B8 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,00007FF7591944A3,?), ref: 00007FF7591945D4
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,00007FF7591944A3,?), ref: 00007FF75919465F

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: ea0dbdd26401f5cb4a0c0125367f5e5ac445343ac2477cca2c429100b6a00301
Instruction ID: 483cbedae866e86ada296367327088923f2b43df55a2c220e876472d7c9d9664
Opcode Fuzzy Hash: ea0dbdd26401f5cb4a0c0125367f5e5ac445343ac2477cca2c429100b6a00301
Instruction Fuzzy Hash: B691D572B0867185FF54AF65A4402BDABB2BB45B88FD85139DE0E57AC4DF38D442C720

Function 00007FF759157C30 Relevance: 6.1, APIs: 4, Instructions: 147COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759157D88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759157D8E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759157D94
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF759157DFC

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 442a3f2e63092959279047d9b46c0cbf53dc3d671d930b4cddfffc36e77c1ecb
Instruction ID: 26eafdcd751259fffde10a7d8cea71938ec9e6e5e73f1397423d5de36693bb74
Opcode Fuzzy Hash: 442a3f2e63092959279047d9b46c0cbf53dc3d671d930b4cddfffc36e77c1ecb
Instruction Fuzzy Hash: FD519D72715B9591EE04DF28E08527CA379FB04F94F984636EA6C07A89DF38D8A1C340

Function 00007FF7591329B0 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7591DC61C: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7591DC639
Part of subcall function 00007FF7591DC61C: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF7591DC65C

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7591329F1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF759132A16
std::_Facet_Register.LIBCPMT ref: 00007FF759132AC2
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759132B24

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: 80cc20553d9414061597bb60507aa9aa6bd6410c5e84b27eea19aa1e6da68aff
Instruction ID: 2d2b24e277e6e8dbcc6622b85845f92860a79113c612f02f77c3527cf3661bbb
Opcode Fuzzy Hash: 80cc20553d9414061597bb60507aa9aa6bd6410c5e84b27eea19aa1e6da68aff
Instruction Fuzzy Hash: 8A516E22A18B5581EE90FF15F540269B3B4FB84B90F9C5531EA5D07B95DF3CE442C720

Function 00007FF759134BC0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF759134BEB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF759134C10
std::_Facet_Register.LIBCPMT ref: 00007FF759134CBB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF759134D06

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: d97067b01ae72d56d3a67cf2b4b141078492a953b35c66c447eaf66f69042bf1
Instruction ID: 5c98d0d8c639e8082a559494d9d7f048c3bcc6ee9f91f43a30e51bb92e55ba4e
Opcode Fuzzy Hash: d97067b01ae72d56d3a67cf2b4b141078492a953b35c66c447eaf66f69042bf1
Instruction Fuzzy Hash: A3418D22A08B5581FF90AF21F450279A774FB88BA4F8C1532EA9D477A5CF3CE4428720

Function 00007FF7591DB424 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7591DB46D
GetLastError.KERNEL32 ref: 00007FF7591DB47B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF759134E79), ref: 00007FF7591DB4B0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF759134E79), ref: 00007FF7591DB4BE

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: ff24e7c81d8dd03fcc82aaf7c0397415c41f33d4ac3d30ba58ee66f2e510de4b
Instruction ID: 252e08f87e6d35b3e60e439e2c18f01e765c477a6ae06ac769da6ff429483436
Opcode Fuzzy Hash: ff24e7c81d8dd03fcc82aaf7c0397415c41f33d4ac3d30ba58ee66f2e510de4b
Instruction Fuzzy Hash: 89214D76A18B9587E750DF21E44432EB6B4FB88F94F680139DB8A57B55DF3CD4018B10

Function 00007FF7591A7058 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7591A7084
GetCurrentThreadId.KERNEL32 ref: 00007FF7591A7092
GetCurrentProcessId.KERNEL32 ref: 00007FF7591A709E
QueryPerformanceCounter.KERNEL32 ref: 00007FF7591A70AE

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 066ada9d6ce2bb7bf232f60978bcef186f182671c9b57ade480c1311d2a17256
Instruction ID: a0f0fa8a0f19f1991198ad407f86e225ca52a091b829c9c3b9f337044a9dc28c
Opcode Fuzzy Hash: 066ada9d6ce2bb7bf232f60978bcef186f182671c9b57ade480c1311d2a17256
Instruction Fuzzy Hash: 0E111C22B14B018AFB409F61E8542A873B4F719768F881E31DA6D477A4DF78E1598750

Function 00007FF759167D60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF759167DCF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF759167E17

Strings

bad locale name, xrefs: 00007FF759167EEC

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 3a79e3869d5329002dfa2b05c04b2981efa5ddd06461e8928ffccf14c62afc19
Instruction ID: 25b963ccbdf594e8eef13c391e261f0c1c6edcdab2e83a050dbf0039684d0567
Opcode Fuzzy Hash: 3a79e3869d5329002dfa2b05c04b2981efa5ddd06461e8928ffccf14c62afc19
Instruction Fuzzy Hash: 5C512632B09A5189FF51EF70E4902BCA3B4EF44748F8C4835EA4D26A99DF38D815D364

Function 00007FF759158314 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

Strings

; expected , xrefs: 00007FF759158427
unexpected , xrefs: 00007FF759158327

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID:
String ID: ; expected $unexpected
API String ID: 0-4241946875
Opcode ID: 5ce981b7561e0fc0e3e85bac79d7e6fce1540aa2c1395d19d479629a61d468d2
Instruction ID: 12645ad0abfcdfc3fb9e7d11201e8cd7e9e6d816681fd7c41ecba09d0d9c61bc
Opcode Fuzzy Hash: 5ce981b7561e0fc0e3e85bac79d7e6fce1540aa2c1395d19d479629a61d468d2
Instruction Fuzzy Hash: 24519162F1469599FF01EFA8E4403AC6B72EB007A8F990235DE1D5BAC9DF789486D310

Function 00007FF759147440 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7591474AF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7591474F7

Strings

bad locale name, xrefs: 00007FF7591475D6

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: ea6d5cef10d377d8c29865afa92fd0f44ff4892c0c6462302a2e263c04c2e362
Instruction ID: a6918f0d3ad819db3e1dc672e36ae9510e96eadead36e2f417ca0822db555f1b
Opcode Fuzzy Hash: ea6d5cef10d377d8c29865afa92fd0f44ff4892c0c6462302a2e263c04c2e362
Instruction Fuzzy Hash: C9512932B09A1189FF51EFA0E4902BCB3B4EF48748F8C4435EA4D6AA99DF38D515D364

Function 00007FF75919A4A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF75919F884: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75919F8B7

_get_daylight.LIBCMT ref: 00007FF75919A5BC
_get_daylight.LIBCMT ref: 00007FF75919A5CD

Strings

?, xrefs: 00007FF75919A54D

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 178c9834567cdffd03bac7faf45fa38e90026ec5dba761da37376aa49044c63e
Instruction ID: 2c03e37dd98aaa3ed8fb783e917140018181e953c59e3f899bbc27cc0aa9f16a
Opcode Fuzzy Hash: 178c9834567cdffd03bac7faf45fa38e90026ec5dba761da37376aa49044c63e
Instruction Fuzzy Hash: 6241E422B082A256FF64AF25B41137AE6B2EB80BA4F984235EF5D06AD5DF3CD445C710

Function 00007FF759194190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7591942A7
GetLastError.KERNEL32 ref: 00007FF7591942C9

Strings

U, xrefs: 00007FF759194253

Memory Dump Source

Source File: 00000000.00000002.1884659745.00007FF7590F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7590F0000, based on PE: true

Associated: 00000000.00000002.1884628460.00007FF7590F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884772591.00007FF759202000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884876661.00007FF7592D4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884906724.00007FF7592D6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1884982232.00007FF7592D9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1885013118.00007FF7592DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7590f0000_zmpZMfK1b4.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1a35e0ff9681dd9ffee4af38256a35880782598a07eb70b704dcc49749e705a6
Instruction ID: 00cf2027dc933ff85a41ec186fbd978c6c28f277d949ac2258d0a49e193976bb
Opcode Fuzzy Hash: 1a35e0ff9681dd9ffee4af38256a35880782598a07eb70b704dcc49749e705a6
Instruction Fuzzy Hash: D441D222B18A6186EB50AF65F4443AAB7B1FB88784F895131EE4D87788EF3CD441C750

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zmpZMfK1b4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
zmpZMfK1b4.exe

Function 00007FF75914D2B0 Relevance: 57.4, APIs: 26, Strings: 6, Instructions: 1378
COMMON

Function 00007FF7591731C0 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 227
windowCOMMON

Function 00007FF7591B3180 Relevance: 43.1, APIs: 9, Strings: 15, Instructions: 1071
COMMON

Function 00007FF75912E240 Relevance: 35.9, APIs: 17, Strings: 3, Instructions: 862
libraryloaderCOMMON

Function 00007FF759127AA0 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 797
fileCOMMON

Function 00007FF759154200 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 599
COMMON

Function 00007FF7591DB5E0 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 00007FF759124A50 Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 369
registryCOMMON

Function 00007FF75912D6E0 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 671
COMMON

Function 00007FF75917C9C0 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 410
COMMON

Function 00007FF7591696D0 Relevance: 19.7, APIs: 9, Strings: 2, Instructions: 413
COMMON

Function 00007FF759172890 Relevance: 16.9, APIs: 11, Instructions: 408
networkfileCOMMON

Function 00007FF75912F2E0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 328
processCOMMON

Function 00007FF75916D260 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 250
networkCOMMON

Function 00007FF75916C1B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 194
windowCOMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre