Edit tour

Windows Analysis Report
mSLEwIfTGL.exe

Overview

General Information

Sample name:	mSLEwIfTGL.exe renamed because original name is a hash value
Original sample name:	bce5589932044903237879f0e9e4840e.exe
Analysis ID:	1520463
MD5:	bce5589932044903237879f0e9e4840e
SHA1:	2df044c89198fde64eb0b5a7c8182addf3486a2b
SHA256:	1c123f8cd194d826aaa48e97fa67b9db9faa1a5a1ada139f367d56904f6e0c04
Tags:	exeuser-abuse_ch
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

mSLEwIfTGL.exe (PID: 2916 cmdline: "C:\Users\user\Desktop\mSLEwIfTGL.exe" MD5: BCE5589932044903237879F0E9E4840E)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: mSLEwIfTGL.exe PID: 2916	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: mSLEwIfTGL.exe PID: 2916	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:25:03.608969+0200	2049441	1	A Network Trojan was detected	192.168.2.4	49730	176.124.204.206	15666	TCP
2024-09-27T11:25:03.909389+0200	2049441	1	A Network Trojan was detected	192.168.2.4	49730	176.124.204.206	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:25:03.608969+0200	2050806	1	A Network Trojan was detected	192.168.2.4	49730	176.124.204.206	15666	TCP
2024-09-27T11:25:03.909389+0200	2050806	1	A Network Trojan was detected	192.168.2.4	49730	176.124.204.206	15666	TCP
2024-09-27T11:25:03.979117+0200	2050806	1	A Network Trojan was detected	192.168.2.4	49730	176.124.204.206	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:25:03.608969+0200	2050807	1	A Network Trojan was detected	192.168.2.4	49730	176.124.204.206	15666	TCP
2024-09-27T11:25:03.909389+0200	2050807	1	A Network Trojan was detected	192.168.2.4	49730	176.124.204.206	15666	TCP
2024-09-27T11:25:03.979117+0200	2050807	1	A Network Trojan was detected	192.168.2.4	49730	176.124.204.206	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: mSLEwIfTGL.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: mSLEwIfTGL.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D661CF0 CryptUnprotectData,LocalFree,		0_2_00007FF76D661CF0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D627C80 CryptUnprotectData,LocalFree,_invalid_parameter_noinfo_noreturn,		0_2_00007FF76D627C80

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: mSLEwIfTGL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6AC088 FindClose,FindFirstFileExW,GetLastError,		0_2_00007FF76D6AC088
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6AC138 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_00007FF76D6AC138

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D67AB00 GetLogicalDriveStringsW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF76D67AB00

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:49730 -> 176.124.204.206:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:49730 -> 176.124.204.206:15666
Source: Network traffic	Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49730 -> 176.124.204.206:15666

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 176.124.204.206:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: GULFSTREAMUA GULFSTREAMUA

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D678A50 InternetOpenA,InternetOpenUrlA,HttpQueryInfoW,HttpQueryInfoW,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,InternetCloseHandle,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,

0_2_00007FF76D678A50

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: mSLEwIfTGL.exe, 00000000.00000003.1852899928.0000015830C51000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.2031707337.0000015830C60000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.2031677658.0000015830C60000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.2031796016.0000015830C64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.t/Regi
Source: mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EFCE000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1853410663.000001582EFE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EF7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/AA
Source: mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EFCE000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4L
Source: mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbW
Source: mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: mSLEwIfTGL.exe, 00000000.00000003.1868698206.0000015830DE8000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1877494395.0000015831A5E000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1873812276.0000015831DDB000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B42000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B4A000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1868698206.0000015830DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831AAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: mSLEwIfTGL.exe, 00000000.00000003.1855374086.000001582EFFF000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831A6F000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831A89000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1855229278.00000158319F2000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831AAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: mSLEwIfTGL.exe, 00000000.00000003.1855374086.000001582EFFF000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831A6F000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831A89000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1855229278.00000158319F2000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc9
Source: mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: mSLEwIfTGL.exe, 00000000.00000003.1868698206.0000015830DE8000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1877494395.0000015831A5E000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1873812276.0000015831DDB000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B42000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B4A000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1868698206.0000015830DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: mSLEwIfTGL.exe, 00000000.00000003.1868698206.0000015830DEF000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1873812276.0000015831DE2000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: mSLEwIfTGL.exe, 00000000.00000003.1868698206.0000015830DEF000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1873812276.0000015831DE2000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D679310 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,GetObjectW,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,DeleteObject,EnterCriticalSection,EnterCriticalSection,GdiplusShutdown,LeaveCriticalSection,LeaveCriticalSection,_invalid_parameter_noinfo_noreturn,

0_2_00007FF76D679310

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D67DD50 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,_invalid_parameter_noinfo_noreturn,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,		0_2_00007FF76D67DD50
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D67D610 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		0_2_00007FF76D67D610

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D621D4E	0_2_00007FF76D621D4E
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D67ADB0	0_2_00007FF76D67ADB0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6800A8	0_2_00007FF76D6800A8
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6340B0	0_2_00007FF76D6340B0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D671F20	0_2_00007FF76D671F20
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D679FB0	0_2_00007FF76D679FB0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D680A90	0_2_00007FF76D680A90
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D651A80	0_2_00007FF76D651A80
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D67BA60	0_2_00007FF76D67BA60
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D678A50	0_2_00007FF76D678A50
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D64BAF0	0_2_00007FF76D64BAF0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D62C9C0	0_2_00007FF76D62C9C0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D62EC50	0_2_00007FF76D62EC50
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D699D08	0_2_00007FF76D699D08
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D620BD0	0_2_00007FF76D620BD0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D62E5A0	0_2_00007FF76D62E5A0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6677F0	0_2_00007FF76D6677F0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D679310	0_2_00007FF76D679310
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6212C0	0_2_00007FF76D6212C0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D682150	0_2_00007FF76D682150
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6AC138	0_2_00007FF76D6AC138
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D678210	0_2_00007FF76D678210
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D62D510	0_2_00007FF76D62D510
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D696504	0_2_00007FF76D696504
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D64E4E0	0_2_00007FF76D64E4E0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D673360	0_2_00007FF76D673360
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6A0E74	0_2_00007FF76D6A0E74
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65FE50	0_2_00007FF76D65FE50
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65DF00	0_2_00007FF76D65DF00
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D64AF00	0_2_00007FF76D64AF00
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D664EF0	0_2_00007FF76D664EF0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D689EE4	0_2_00007FF76D689EE4
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D62BEE0	0_2_00007FF76D62BEE0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D627ED0	0_2_00007FF76D627ED0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D666D70	0_2_00007FF76D666D70
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D67DD50	0_2_00007FF76D67DD50
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D68BE00	0_2_00007FF76D68BE00
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D62AE00	0_2_00007FF76D62AE00
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D68E10C	0_2_00007FF76D68E10C
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6400ED	0_2_00007FF76D6400ED
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D5F60C0	0_2_00007FF76D5F60C0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D67E0A0	0_2_00007FF76D67E0A0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D699F84	0_2_00007FF76D699F84
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D646F70	0_2_00007FF76D646F70
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65CF60	0_2_00007FF76D65CF60
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6AEFD0	0_2_00007FF76D6AEFD0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D668FD0	0_2_00007FF76D668FD0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D629A59	0_2_00007FF76D629A59
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D691B14	0_2_00007FF76D691B14
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D68DAC4	0_2_00007FF76D68DAC4
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6899EC	0_2_00007FF76D6899EC
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6849BA	0_2_00007FF76D6849BA
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D66F9C0	0_2_00007FF76D66F9C0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D68E9A4	0_2_00007FF76D68E9A4
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D698C2C	0_2_00007FF76D698C2C
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D663CC0	0_2_00007FF76D663CC0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D697CAC	0_2_00007FF76D697CAC
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D63CB90	0_2_00007FF76D63CB90
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6AEB50	0_2_00007FF76D6AEB50
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65DBD0	0_2_00007FF76D65DBD0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6B3BC0	0_2_00007FF76D6B3BC0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D69762C	0_2_00007FF76D69762C
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D66F620	0_2_00007FF76D66F620
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D68D6F4	0_2_00007FF76D68D6F4
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6666D0	0_2_00007FF76D6666D0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65D590	0_2_00007FF76D65D590
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D659600	0_2_00007FF76D659600
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6745D0	0_2_00007FF76D6745D0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65F820	0_2_00007FF76D65F820
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D5F6900	0_2_00007FF76D5F6900
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6218F0	0_2_00007FF76D6218F0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D68D8DC	0_2_00007FF76D68D8DC
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65D8B0	0_2_00007FF76D65D8B0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D676783	0_2_00007FF76D676783
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D616770	0_2_00007FF76D616770
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D676773	0_2_00007FF76D676773
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D619760	0_2_00007FF76D619760
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D672750	0_2_00007FF76D672750
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6177B0	0_2_00007FF76D6177B0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D668270	0_2_00007FF76D668270
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65D260	0_2_00007FF76D65D260
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D655220	0_2_00007FF76D655220
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6712F0	0_2_00007FF76D6712F0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D660180	0_2_00007FF76D660180
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D69717C	0_2_00007FF76D69717C
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D5F6480	0_2_00007FF76D5F6480
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D63E419	0_2_00007FF76D63E419
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D69A50C	0_2_00007FF76D69A50C
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D63C4E0	0_2_00007FF76D63C4E0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D68E49C	0_2_00007FF76D68E49C
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6983D8	0_2_00007FF76D6983D8

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: String function: 00007FF76D61D510 appears 63 times
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: String function: 00007FF76D621D20 appears 54 times
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: String function: 00007FF76D626990 appears 41 times

Source: classification engine

Classification label: mal96.troj.spyw.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D62E5A0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF76D62E5A0

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D65F820 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysFreeString,SysFreeString,SysStringByteLen,SysFreeString,SysFreeString,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF76D65F820

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69633C615BB6

Source: mSLEwIfTGL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: mSLEwIfTGL.exe

ReversingLabs: Detection: 31%

Source: mSLEwIfTGL.exe	String found in binary or memory: --help
Source: mSLEwIfTGL.exe	String found in binary or memory: --help
Source: mSLEwIfTGL.exe	String found in binary or memory: --help
Source: mSLEwIfTGL.exe	String found in binary or memory: --help
Source: mSLEwIfTGL.exe	String found in binary or memory: ipportgrabber_max_sizeextensionslinksbuild_nameself_destructtype must be boolean, but is type must be number, but is 0123456789ABCDEFntdll.dllFile DownloaderabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'runasopen bad variant accessfalsetrueBad any_cast[VAR... , [default: [required][nargs: or more] ..[nargs= to or more provided. argument(s) expected. : required.: no value provided.-=--help-hshows help message and exits--version-vprints version information and exitsNo such argument:
Source: mSLEwIfTGL.exe	String found in binary or memory: ipportgrabber_max_sizeextensionslinksbuild_nameself_destructtype must be boolean, but is type must be number, but is 0123456789ABCDEFntdll.dllFile DownloaderabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'runasopen bad variant accessfalsetrueBad any_cast[VAR... , [default: [required][nargs: or more] ..[nargs= to or more provided. argument(s) expected. : required.: no value provided.-=--help-hshows help message and exits--version-vprints version information and exitsNo such argument:

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: mSLEwIfTGL.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: mSLEwIfTGL.exe

Static file information: File size 1117696 > 1048576

Source: mSLEwIfTGL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: mSLEwIfTGL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: mSLEwIfTGL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: mSLEwIfTGL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: mSLEwIfTGL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: mSLEwIfTGL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: mSLEwIfTGL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: mSLEwIfTGL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: mSLEwIfTGL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: mSLEwIfTGL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: mSLEwIfTGL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: mSLEwIfTGL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: mSLEwIfTGL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D62D510 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF76D62D510

Source: mSLEwIfTGL.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65CB00 push rsp; retf	0_2_00007FF76D65CBA1
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65CBBC push rsp; retf	0_2_00007FF76D65CBBD
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65CBB8 push rsp; retf	0_2_00007FF76D65CBB9
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65CBC4 push rsp; retf	0_2_00007FF76D65CBC5
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65CBC0 push rsp; retf	0_2_00007FF76D65CBC1
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65CBAC push rsp; retf	0_2_00007FF76D65CBAD
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65CBB4 push rsp; retf	0_2_00007FF76D65CBB5
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D65CBB0 push rsp; retf	0_2_00007FF76D65CBB1

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D6677F0 _invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,ExitProcess,ExitProcess,OpenMutexA,ExitProcess,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF76D6677F0

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-71404

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6AC088 FindClose,FindFirstFileExW,GetLastError,		0_2_00007FF76D6AC088
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6AC138 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,		0_2_00007FF76D6AC138

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D67AB00 GetLogicalDriveStringsW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF76D67AB00

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D690220 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

0_2_00007FF76D690220

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EFCE000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EF89000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1853410663.000001582EFE8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

API call chain: ExitProcess graph end node

graph_0-70153

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D67DD50 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,_invalid_parameter_noinfo_noreturn,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

0_2_00007FF76D67DD50

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D688A38 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF76D688A38

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D6AE2B0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF76D6AE2B0

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

0_2_00007FF76D62D510

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D688A38 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF76D688A38
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: 0_2_00007FF76D6A5870 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF76D6A5870

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: GetLocaleInfoW,	0_2_00007FF76D6950AC
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF76D69FFF0
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: EnumSystemLocalesW,	0_2_00007FF76D69FAE4
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_00007FF76D6ABC84
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: EnumSystemLocalesW,	0_2_00007FF76D694B68
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: EnumSystemLocalesW,	0_2_00007FF76D69FBB4
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF76D69F798
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF76D6A01CC

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D68F67C GetSystemTimeAsFileTime,

0_2_00007FF76D68F67C

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D679A60 GetUserNameW,

0_2_00007FF76D679A60

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Code function: 0_2_00007FF76D67ADB0 GetTimeZoneInformation,

0_2_00007FF76D67ADB0

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: mSLEwIfTGL.exe PID: 2916, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: mSLEwIfTGL.exe PID: 2916, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EF89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum-LTC\config
Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EF89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: KHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzMl0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNDddCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K
Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EF89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EF89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EF89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\mSLEwIfTGL.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\mSLEwIfTGL.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: mSLEwIfTGL.exe PID: 2916, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match

File source: Process Memory Space: mSLEwIfTGL.exe PID: 2916, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 Obfuscated Files or Information	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Email Collection	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 Account Discovery	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	24 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mSLEwIfTGL.exe	32%	ReversingLabs	Win64.Trojan.SpywareX
mSLEwIfTGL.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/AA	mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EF7A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B52000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbW	mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EFCE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EFCE000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831AAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831AAE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B52000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	mSLEwIfTGL.exe, 00000000.00000003.1855374086.000001582EFFF000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831A6F000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831A89000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1855229278.00000158319F2000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831A5E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc9	mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EFCE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org	mSLEwIfTGL.exe, 00000000.00000003.1868698206.0000015830DE8000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1877494395.0000015831A5E000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1873812276.0000015831DDB000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B42000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1877326669.0000015831B4A000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1868698206.0000015830DE0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	mSLEwIfTGL.exe, 00000000.00000003.1855374086.000001582EFFF000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831A6F000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831A89000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1855229278.00000158319F2000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854811805.0000015831A5E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4L	mSLEwIfTGL.exe, 00000000.00000002.2032359148.000001582EFCE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.microsoft.t/Regi	mSLEwIfTGL.exe, 00000000.00000003.1852899928.0000015830C51000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.2031707337.0000015830C60000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.2031677658.0000015830C60000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.2031796016.0000015830C64000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	mSLEwIfTGL.exe, 00000000.00000003.1854232533.0000015831A46000.00000004.00000020.00020000.00000000.sdmp, mSLEwIfTGL.exe, 00000000.00000003.1854551100.0000015831A46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	mSLEwIfTGL.exe, 00000000.00000003.1878151731.000001582EFFE000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.124.204.206	unknown	Russian Federation		59652	GULFSTREAMUA	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520463
Start date and time:	2024-09-27 11:23:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mSLEwIfTGL.exe renamed because original name is a hash value
Original Sample Name:	bce5589932044903237879f0e9e4840e.exe
Detection:	MAL
Classification:	mal96.troj.spyw.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 93 Number of non-executed functions: 92
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: mSLEwIfTGL.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.74.152	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	RTGS-WB-ABS-240730-NEW.lnk	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://mzansibonds.com/dshk/tmpasdfghjklkjhgfdewertyuioiuytresdxcvbnmnbvfcdsew345678987654rewsdfvgbhnjhbgvfdesw23e45678uijdhgfcsvzbdncqasdcxw.php	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://correctingservicesalakks.pages.dev/	Get hash	malicious	Unknown	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.26.12.205
	https://lothanse-heracklarne.pages.dev/help/contact/547074160798771	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GULFSTREAMUA	https://darlin.com.au/	Get hash	malicious	Unknown	Browse	176.124.222.157
	LisectAVT_2403002A_415.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	176.124.220.79
	qObijSd3Uj.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	176.124.220.79
	zqixOh6Ktr.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	176.124.192.196
	FaOty5cPp0.elf	Get hash	malicious	Unknown	Browse	176.124.192.196
	Xzia5WAjUb.elf	Get hash	malicious	Unknown	Browse	176.124.192.196
	a7GTGrV0u5.elf	Get hash	malicious	Unknown	Browse	176.124.192.196
	Jy730hXzc6.elf	Get hash	malicious	Unknown	Browse	176.124.192.196
	uWnjyWVnz5.elf	Get hash	malicious	Unknown	Browse	176.124.192.196
	oEsBkfNz24.elf	Get hash	malicious	Unknown	Browse	176.124.192.196
CLOUDFLARENETUS	kewyIO69TI.exe	Get hash	malicious	LummaC	Browse	104.21.58.182
	bfINGx7hvL.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	9q24V7OSys.exe	Get hash	malicious	FormBook	Browse	104.21.69.238
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	GEsD6lobvy.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	188.114.97.3
	GfGxum1sf3.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	162.159.130.233
	https://strato.de-sys.online/HJd9cn-2tRRO-rDZDs-D6p99-HbdYU-wK4oY-FICwzl/index.html	Get hash	malicious	HTMLPhisher	Browse	104.18.94.41

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	#docs_8299010377388200191-pdf.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	175-33-26-24.HTA.hta	Get hash	malicious	Unknown	Browse	172.67.74.152
	zlsXub68El.exe	Get hash	malicious	Vidar	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	172.67.74.152
	SecuriteInfo.com.Adware.DownwareNET.4.15389.24193.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	172.67.74.152
	SecuriteInfo.com.Adware.DownwareNET.4.15389.24193.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	172.67.74.152

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.389131086793418
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mSLEwIfTGL.exe
File size:	1'117'696 bytes
MD5:	bce5589932044903237879f0e9e4840e
SHA1:	2df044c89198fde64eb0b5a7c8182addf3486a2b
SHA256:	1c123f8cd194d826aaa48e97fa67b9db9faa1a5a1ada139f367d56904f6e0c04
SHA512:	51b487e2cca437e77bd45a19fee976e04ab3e64f5723c946757566d77961e3420a779d2c55af1b607a5c8930370288dadaa6862f00645bddf5c8a7c75bc47de3
SSDEEP:	24576:qBZ3miL8zJa5e9AISUzOL9A5qU7wQmzXrbv4nlxlGYGeIVuj:I3miL8Me9AISUzCDIwQ0X4g5eIVu
TLSH:	5E354A15195D02EDD5BE817C8E5A9A13F63638460371A7EB16D187523FA3BE0AF3E320
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:%~.~D.R~D.R~D.R.6.S.D.R.6.S.D.R.:.S!D.R.:.SoD.R.:.SvD.R.6.S.D.R.6.SrD.R.6.ShD.R~D.RgE.R.6.ScD.Rj;.SqD.Rj;.R.D.Rj;.S.D.RRich~D.

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x1400b5d64
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F562DB [Thu Sep 26 13:34:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2c34752585cf27cdff9273031768b19e

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F1420DF8F50h
dec eax
add esp, 28h
jmp 00007F1420DF880Fh
int3
int3
and dword ptr [000551E1h], 00000000h
ret
dec eax
mov dword ptr [esp+08h], ebx
push ebp
dec eax
lea ebp, dword ptr [esp-000004C0h]
dec eax
sub esp, 000005C0h
mov ebx, ecx
mov ecx, 00000017h
call dword ptr [0002250Eh]
test eax, eax
je 00007F1420DF8996h
mov ecx, ebx
int 29h
mov ecx, 00000003h
call 00007F1420DF8959h
xor edx, edx
dec eax
lea ecx, dword ptr [ebp-10h]
inc ecx
mov eax, 000004D0h
call 00007F1420DFA7C0h
dec eax
lea ecx, dword ptr [ebp-10h]
call dword ptr [000224B1h]
dec eax
mov ebx, dword ptr [ebp+000000E8h]
dec eax
lea edx, dword ptr [ebp+000004D8h]
dec eax
mov ecx, ebx
inc ebp
xor eax, eax
call dword ptr [0002249Fh]
dec eax
test eax, eax
je 00007F1420DF89CEh
dec eax
and dword ptr [esp+38h], 00000000h
dec eax
lea ecx, dword ptr [ebp+000004E0h]
dec eax
mov edx, dword ptr [ebp+000004D8h]
dec esp
mov ecx, eax
dec eax
mov dword ptr [esp+30h], ecx
dec esp
mov eax, ebx
dec eax
lea ecx, dword ptr [ebp+000004E8h]
dec eax
mov dword ptr [esp+28h], ecx
dec eax
lea ecx, dword ptr [ebp-10h]
dec eax
mov dword ptr [esp+20h], ecx
xor ecx, ecx
call dword ptr [00022466h]
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x101f28	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x115000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x10d000	0x6f90	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x116000	0xd64	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xeb6d0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xeb780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xeb590	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd8000	0x728	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xd6ecc	0xd7000	f7f58667ed931baa011f0542823c202c	False	0.4291583393895349	zlib compressed data	6.324832116924724	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xd8000	0x2b6c8	0x2b800	906e8db590a919e958e9afeb900d475a	False	0.47395272090517243	data	5.69481860969668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x104000	0x85a4	0x6000	5fbcdd9847679f1c63be9c85e41b833e	False	0.08390299479166667	data	4.559223452785583	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x10d000	0x6f90	0x7000	9f28ea92727e464a67682730ecd8aeb3	False	0.48489815848214285	data	6.043376095189614	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x114000	0x15c	0x200	b52e28908fd472740186bf885f303a5f	False	0.40625	data	3.345113144897087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x115000	0x1e0	0x200	da9e8769aa702da1ca0713d6a0336d18	False	0.529296875	data	4.7122981932940915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x116000	0xd64	0xe00	36456480ce7be1ea5f3ce9804abc508f	False	0.48046875	data	5.354911204937075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x115060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
WS2_32.dll	inet_pton, WSAStartup, send, socket, connect, recv, closesocket, htons, WSACleanup
CRYPT32.dll	CryptUnprotectData
WININET.dll	HttpQueryInfoW, InternetQueryDataAvailable, InternetReadFile, InternetCloseHandle, InternetOpenW, InternetOpenA, InternetOpenUrlA
ntdll.dll	NtQuerySystemInformation, RtlInitUnicodeString, NtAllocateVirtualMemory, LdrEnumerateLoadedModules, RtlAcquirePebLock, RtlReleasePebLock, NtQueryObject
RstrtMgr.DLL	RmGetList, RmStartSession, RmRegisterResources, RmEndSession
KERNEL32.dll	CompareStringEx, LCMapStringEx, FindFirstFileW, FindNextFileW, FindClose, OpenProcess, CreateToolhelp32Snapshot, Process32NextW, LoadLibraryA, Process32FirstW, CloseHandle, GetSystemInfo, GetProcAddress, LocalFree, FreeLibrary, ExitProcess, MultiByteToWideChar, WideCharToMultiByte, TerminateProcess, GetModuleFileNameW, CreateMutexA, ReleaseMutex, OpenMutexA, ReadFile, GetModuleFileNameA, GetVolumeInformationW, SetHandleInformation, GetGeoInfoA, HeapFree, EnterCriticalSection, GetCurrentProcess, GetStdHandle, GetProcessId, LeaveCriticalSection, CreatePipe, SetFilePointer, InitializeCriticalSectionEx, FreeEnvironmentStringsW, GetModuleHandleA, HeapSize, GetLogicalDriveStringsW, GetFinalPathNameByHandleA, GetTimeZoneInformation, GetLastError, lstrcatW, HeapReAlloc, HeapAlloc, GetUserGeoID, DecodePointer, GetFileSize, DeleteCriticalSection, GetComputerNameW, GetProcessHeap, GlobalMemoryStatusEx, GetModuleHandleW, lstrcpyW, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetSystemTimeAsFileTime, GetModuleHandleExW, GetCommandLineA, GetCommandLineW, VirtualAlloc, VirtualProtect, VirtualQuery, GetFileSizeEx, SetFilePointerEx, GetCurrentThreadId, GetFileType, GetStartupInfoW, FlushFileBuffers, WriteFile, GetConsoleOutputCP, GetConsoleMode, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, LoadLibraryExW, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, ReadConsoleW, RaiseException, SetStdHandle, IsValidCodePage, GetACP, SetEndOfFile, GetCPInfo, GetStringTypeW, CreateFileW, WriteConsoleW, OutputDebugStringW, SetEnvironmentVariableW, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, QueryPerformanceCounter, InitializeSListHead, RtlUnwindEx, RtlUnwind, RtlPcToFileHeader, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetNativeSystemInfo, GetFileInformationByHandleEx, GetEnvironmentStringsW, CreateProcessA, GetOEMCP, AreFileApisANSI, GetTempPathW, SetFileInformationByHandle, GetFileAttributesExW, GetFileAttributesW, FindFirstFileExW, GetCurrentDirectoryW, GetLocaleInfoEx, FormatMessageA
USER32.dll	EnumDisplayDevicesW, GetDesktopWindow, GetWindowRect, ReleaseDC, GetSystemMetrics, GetDC
GDI32.dll	CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, BitBlt, DeleteDC, GetObjectW, DeleteObject, GetDeviceCaps
ADVAPI32.dll	GetCurrentHwProfileW, RegCloseKey, RegGetValueA, RegQueryValueExA, OpenProcessToken, RegOpenKeyExA, GetUserNameW, RegEnumKeyExA, GetTokenInformation, CredEnumerateA, CredFree
SHELL32.dll	SHGetKnownFolderPath, ShellExecuteW
ole32.dll	CoInitializeSecurity, CoGetObject, CoTaskMemFree, CoUninitialize, CoCreateInstance, CoSetProxyBlanket, CoInitializeEx
OLEAUT32.dll	SysAllocStringByteLen, SysFreeString, SysStringByteLen
SHLWAPI.dll
gdiplus.dll	GdipSaveImageToStream, GdipGetImageEncodersSize, GdipFree, GdiplusStartup, GdiplusShutdown, GdipGetImageEncoders, GdipCloneImage, GdipAlloc, GdipCreateBitmapFromHBITMAP, GdipDisposeImage, GdipCreateBitmapFromScan0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T11:25:03.608969+0200	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49730	176.124.204.206	15666	TCP
2024-09-27T11:25:03.608969+0200	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	176.124.204.206	15666	TCP
2024-09-27T11:25:03.608969+0200	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	176.124.204.206	15666	TCP
2024-09-27T11:25:03.909389+0200	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49730	176.124.204.206	15666	TCP
2024-09-27T11:25:03.909389+0200	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	176.124.204.206	15666	TCP
2024-09-27T11:25:03.909389+0200	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	176.124.204.206	15666	TCP
2024-09-27T11:25:03.979117+0200	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	176.124.204.206	15666	TCP
2024-09-27T11:25:03.979117+0200	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	176.124.204.206	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 11:24:57.382607937 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:24:57.387610912 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:24:57.387702942 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:24:57.457479954 CEST	49731	443	192.168.2.4	172.67.74.152
Sep 27, 2024 11:24:57.457544088 CEST	443	49731	172.67.74.152	192.168.2.4
Sep 27, 2024 11:24:57.457609892 CEST	49731	443	192.168.2.4	172.67.74.152
Sep 27, 2024 11:24:57.533023119 CEST	49731	443	192.168.2.4	172.67.74.152
Sep 27, 2024 11:24:57.533076048 CEST	443	49731	172.67.74.152	192.168.2.4
Sep 27, 2024 11:24:57.995872021 CEST	443	49731	172.67.74.152	192.168.2.4
Sep 27, 2024 11:24:57.995939970 CEST	49731	443	192.168.2.4	172.67.74.152
Sep 27, 2024 11:24:58.054265022 CEST	49731	443	192.168.2.4	172.67.74.152
Sep 27, 2024 11:24:58.054291010 CEST	443	49731	172.67.74.152	192.168.2.4
Sep 27, 2024 11:24:58.054672956 CEST	443	49731	172.67.74.152	192.168.2.4
Sep 27, 2024 11:24:58.054738998 CEST	49731	443	192.168.2.4	172.67.74.152
Sep 27, 2024 11:24:58.055905104 CEST	49731	443	192.168.2.4	172.67.74.152
Sep 27, 2024 11:24:58.103398085 CEST	443	49731	172.67.74.152	192.168.2.4
Sep 27, 2024 11:24:58.160468102 CEST	443	49731	172.67.74.152	192.168.2.4
Sep 27, 2024 11:24:58.160536051 CEST	443	49731	172.67.74.152	192.168.2.4
Sep 27, 2024 11:24:58.160533905 CEST	49731	443	192.168.2.4	172.67.74.152
Sep 27, 2024 11:24:58.160578012 CEST	49731	443	192.168.2.4	172.67.74.152
Sep 27, 2024 11:24:58.170435905 CEST	49731	443	192.168.2.4	172.67.74.152
Sep 27, 2024 11:24:58.170461893 CEST	443	49731	172.67.74.152	192.168.2.4
Sep 27, 2024 11:25:03.608968973 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.909389019 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.978773117 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.978844881 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.978935957 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.978975058 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.979058027 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.979068995 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.979093075 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.979116917 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.979120970 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.979136944 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.979161978 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.979166031 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.979171991 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.979213953 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.979222059 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.979233027 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.979243994 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.979284048 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.985739946 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.985750914 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.985759974 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.985833883 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.986155987 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.986166000 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.986215115 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.986763000 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.986773014 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.986819029 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.986840963 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.986859083 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.986885071 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.986895084 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.986911058 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.986944914 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.990415096 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.990425110 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.990441084 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.990449905 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.990467072 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.990503073 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.990523100 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.990829945 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.990889072 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.990936041 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.990991116 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.991491079 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.991542101 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.991550922 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.991609097 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.991728067 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.991770029 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.991785049 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.991817951 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.995918989 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.995939016 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996012926 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996093035 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996170998 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996195078 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996203899 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996222019 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996229887 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996258974 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996263027 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996280909 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996296883 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996311903 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996335983 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996380091 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996388912 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996400118 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996429920 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996443033 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996447086 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996476889 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996479034 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996521950 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996526003 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996553898 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996562004 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996568918 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996602058 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996644020 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996654034 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996700048 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996701956 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996711969 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996737003 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996745110 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996757984 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996781111 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996787071 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996807098 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996841908 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996851921 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996860981 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996905088 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996907949 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996913910 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996948004 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996957064 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.996963024 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996985912 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.996993065 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.997020006 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.997044086 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:03.997072935 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:03.997117996 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.000636101 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.000648022 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.000677109 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.000684023 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.000703096 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.000730991 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.000731945 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.000741959 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.000787020 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.002079010 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002089024 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002098083 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002101898 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002145052 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.002146959 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002156019 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002166986 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.002180099 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002190113 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002197027 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.002233982 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.002635002 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002644062 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002679110 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002688885 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002692938 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.002723932 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002732992 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002733946 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.002770901 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002779007 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002784967 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.002788067 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002799034 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002810001 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.002815962 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002825022 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002861977 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.002887011 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.002950907 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002959013 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002968073 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002975941 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002984047 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.002993107 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.003009081 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.003015041 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.003016949 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.003026009 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.003036022 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.003076077 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.003103018 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.003743887 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.003796101 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.003865957 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.003909111 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.003911018 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.003917933 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.003943920 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.003951073 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.003963947 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.003988981 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.003993988 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004004955 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004010916 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004031897 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004040003 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004050016 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004069090 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004085064 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004093885 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004101992 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004129887 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004138947 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004143000 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004163027 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004199028 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004204035 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004209995 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004271030 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004280090 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004291058 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004339933 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004354000 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004363060 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004384995 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004393101 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004406929 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004424095 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004445076 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004452944 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004460096 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004475117 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004482985 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004486084 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004504919 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004515886 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004524946 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004534006 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004554987 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004569054 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004578114 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004590034 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004615068 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004623890 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004626036 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004653931 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004683018 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004705906 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004717112 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004725933 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004734039 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004767895 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004784107 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004786968 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004793882 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004829884 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004849911 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004857063 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004867077 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004903078 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004911900 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004916906 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004935026 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.004961967 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004981995 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.004990101 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.005018950 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.005027056 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.005032063 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.005050898 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.005073071 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.005568027 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.005614996 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.006695032 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.006720066 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.006752968 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.006756067 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.006764889 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.006769896 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.006794930 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.006814003 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.006824970 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.006834030 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.006879091 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.006886005 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.006896019 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.006906986 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.006931067 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.006942987 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.006968975 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.006982088 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.006990910 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.006992102 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007021904 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007042885 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007437944 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007461071 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007486105 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007505894 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007512093 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007523060 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007531881 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007541895 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007555962 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007579088 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007587910 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007595062 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007621050 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007648945 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007648945 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007658958 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007689953 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007710934 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007714987 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007751942 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007760048 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007760048 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007788897 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007797003 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007807970 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007808924 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007857084 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007884026 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007893085 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007932901 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007942915 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007956028 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.007993937 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.007994890 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008004904 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008044004 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008055925 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008066893 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008081913 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008096933 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008104086 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008133888 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008136988 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008152962 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008177996 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008181095 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008187056 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008208036 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008217096 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008223057 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008243084 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008265972 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008280993 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008310080 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008311987 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008320093 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008337021 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008344889 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008349895 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008378029 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008399010 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008428097 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008436918 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008466959 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008474112 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008483887 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008486032 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008507967 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008510113 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008517027 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008528948 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008552074 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008563995 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008572102 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008573055 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008603096 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008620977 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008629084 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008666992 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008708954 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008718014 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008727074 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008743048 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008749008 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008750916 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008779049 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008793116 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008801937 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008805037 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008831024 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008831978 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008841991 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008865118 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008866072 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.008891106 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.008908987 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.009716988 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.009741068 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.009768009 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.009788036 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.009794950 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.009804964 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.009838104 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.009848118 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.009856939 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.009859085 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.009886026 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.009903908 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.009915113 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.009923935 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.009955883 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.009969950 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.009974957 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.009980917 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010010004 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010034084 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010056973 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010066032 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010106087 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010113955 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010154963 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010185957 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010195971 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010204077 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010211945 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010221004 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010226965 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010236979 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010246038 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010261059 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010263920 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010272980 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010277987 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010319948 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010328054 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010339022 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010370016 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010374069 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010384083 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010389090 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010418892 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010427952 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010427952 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010478973 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010512114 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010520935 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010560036 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010580063 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010588884 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010611057 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010620117 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010626078 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010647058 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010667086 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010677099 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010678053 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010706902 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010713100 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010724068 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010725975 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010768890 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010809898 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010821104 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010838032 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010845900 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010854959 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010868073 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010875940 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010890961 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010919094 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.010947943 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010988951 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.010997057 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.011001110 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.011030912 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.011039972 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.011049032 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.011056900 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.011089087 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.011090994 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.011101007 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.011141062 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.011141062 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.011151075 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.011197090 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.011419058 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.011457920 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.014740944 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.014877081 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.014885902 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.014909983 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.014911890 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.014976025 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.015053988 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.015110016 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.015171051 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.015233040 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.015250921 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.060357094 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.060664892 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.060755014 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.060822010 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.060878038 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.060950994 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.061017036 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.061088085 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.061148882 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.061186075 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.070406914 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.070631981 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.070903063 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.070969105 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.071017981 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.071079969 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.071134090 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.071193933 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.071245909 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.071310997 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.071332932 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.076734066 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.076756001 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.076766968 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.076797009 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.076828957 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077403069 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077419043 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077428102 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077438116 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077452898 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077456951 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077461958 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077471972 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077480078 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077490091 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077500105 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077508926 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077524900 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077533007 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077534914 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077541113 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077564955 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077574015 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077580929 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077584982 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077599049 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077610970 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077615976 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077642918 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077651024 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077652931 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077662945 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077672005 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077687025 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077694893 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077702999 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077711105 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077718019 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077734947 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077756882 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077765942 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077774048 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077774048 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077790022 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077799082 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077806950 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077814102 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077815056 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077824116 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077831984 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077841043 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077850103 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077852011 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077857971 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077867985 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077877045 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077892065 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077892065 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077900887 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077909946 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077919006 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077925920 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077933073 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077934027 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077945948 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077951908 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077975035 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077982903 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.077984095 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.077991962 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078001976 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078003883 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.078011036 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078020096 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078027964 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078042984 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078052044 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078058004 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.078058958 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078068972 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078078032 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078093052 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078102112 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078103065 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.078109980 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078119040 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078126907 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078135014 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078136921 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.078145981 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078155041 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078162909 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078171968 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078180075 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.078180075 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078197002 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.078211069 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.078243017 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079293013 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079303980 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079312086 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079336882 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079359055 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079368114 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079379082 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079401016 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079401970 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079411983 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079421997 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079422951 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079459906 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079468966 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079472065 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079478025 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079489946 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079492092 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079536915 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079571009 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079581022 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079588890 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079606056 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079613924 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079618931 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079622030 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079632044 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079634905 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079641104 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079649925 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079658031 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079667091 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079674959 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079683065 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079690933 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079700947 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079710007 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079713106 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079724073 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079734087 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079741001 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079750061 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079750061 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079757929 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079768896 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079777956 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079780102 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079786062 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079803944 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079812050 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079819918 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079828024 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079830885 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079838037 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079850912 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079860926 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079864979 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079869032 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079878092 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079899073 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079907894 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079911947 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079916000 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079926014 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079941988 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.079942942 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079952955 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.079974890 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.080008984 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.080559969 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080571890 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080610037 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080619097 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080621004 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.080629110 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080637932 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080655098 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080661058 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.080663919 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080673933 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080682039 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080688000 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.080692053 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080739021 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.080763102 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.080815077 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080823898 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080832958 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080849886 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080857992 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080866098 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.080867052 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080877066 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080884933 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.080885887 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080895901 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080904961 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080919981 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080929041 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080936909 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080940962 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080941916 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.080944061 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080960989 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080970049 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.080972910 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081027985 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081049919 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081058979 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081068993 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081078053 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081085920 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081094027 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081099987 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081110001 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081119061 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081129074 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081130028 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081137896 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081146955 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081156015 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081171989 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081180096 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081264973 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081273079 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081289053 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081293106 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081304073 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081314087 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081322908 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081326962 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081331968 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081341028 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081341982 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081351042 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081358910 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081376076 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081382990 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081384897 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081393003 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081403017 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081409931 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081410885 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081419945 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081429005 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081438065 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081439018 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081446886 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081455946 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081465006 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081473112 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081480980 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081489086 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081499100 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081506968 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081515074 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081523895 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081526995 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081537008 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081547022 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081547976 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081556082 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081564903 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081569910 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081573963 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081583023 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081599951 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081603050 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081609011 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081618071 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081626892 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081634998 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081635952 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081644058 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081653118 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081667900 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081676006 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081685066 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081686974 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081692934 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081701994 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081712008 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081721067 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081721067 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081731081 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081739902 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081746101 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081748962 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081765890 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081767082 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081775904 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081784964 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081793070 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081800938 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081800938 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081810951 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081820011 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081828117 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081836939 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081845045 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081851959 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081852913 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081864119 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081878901 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081882954 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081892967 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081902981 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081911087 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081918001 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081919909 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081927061 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081938028 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081939936 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081948042 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081958055 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081962109 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.081965923 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081984043 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.081991911 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082000017 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082007885 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082007885 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.082016945 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082026958 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082036972 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082042933 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.082046032 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082056046 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082065105 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082079887 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.082081079 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082091093 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082099915 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082107067 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082113028 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.082115889 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082124949 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082134008 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082144976 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.082149029 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082159042 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082166910 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.082176924 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.082212925 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.128340006 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.128567934 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129175901 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129245996 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129297018 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129359007 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129409075 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129477024 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129524946 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129586935 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129633904 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129699945 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129754066 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129816055 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129869938 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.129949093 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.130000114 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.130062103 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.130096912 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.170455933 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.170943975 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.171014071 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.171071053 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.171129942 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.171153069 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.175895929 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.176134109 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.176199913 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.176237106 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.216434956 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.216520071 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.231337070 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.231515884 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.231590986 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.231638908 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.231689930 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.231726885 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.236540079 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.236679077 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.280419111 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.280488968 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.307693005 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.307908058 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.307979107 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.308029890 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.308084965 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.308124065 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.312808037 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.313008070 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.313076973 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.313126087 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.313184977 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.313214064 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.360445976 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.360625982 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.373512983 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.373625994 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.373828888 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.373900890 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.373956919 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.374010086 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.374058008 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.374109030 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.374154091 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.374216080 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.374267101 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.374325037 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.374371052 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.379040956 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.379211903 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.379285097 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.379322052 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.420394897 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.420527935 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.434111118 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.434263945 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.434350967 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.434475899 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.434535980 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.434587955 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.434648037 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.434694052 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.434753895 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.434798002 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.434870958 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.434921026 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.434981108 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.434999943 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.439462900 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.439726114 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.439795971 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.439842939 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.439902067 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.439951897 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.440004110 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.440056086 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.440099001 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.480364084 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.480519056 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490056038 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.490272045 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490315914 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.490344048 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490394115 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490452051 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490494967 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490556002 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490602970 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490660906 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490706921 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490763903 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490811110 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490864038 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490906954 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490966082 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.490992069 CEST	15666	49730	176.124.204.206	192.168.2.4
Sep 27, 2024 11:25:04.491015911 CEST	49730	15666	192.168.2.4	176.124.204.206
Sep 27, 2024 11:25:04.491074085 CEST	49730	15666	192.168.2.4	176.124.204.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 11:24:57.444138050 CEST	192.168.2.4	1.1.1.1	0x1b55	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 11:24:57.451389074 CEST	1.1.1.1	192.168.2.4	0x1b55	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:24:57.451389074 CEST	1.1.1.1	192.168.2.4	0x1b55	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Sep 27, 2024 11:24:57.451389074 CEST	1.1.1.1	192.168.2.4	0x1b55	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	172.67.74.152	443	2916	C:\Users\user\Desktop\mSLEwIfTGL.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 09:24:58 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-09-27 09:24:58 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 09:24:58 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c9a71972c827cf3-EWR
2024-09-27 09:24:58 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Target ID:	0
Start time:	05:24:56
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\mSLEwIfTGL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\mSLEwIfTGL.exe"
Imagebase:	0x7ff76d5f0000
File size:	1'117'696 bytes
MD5 hash:	BCE5589932044903237879F0E9E4840E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	41.9%
Total number of Nodes:	1681
Total number of Limit Nodes:	58

Executed Functions

Function 00007FF76D64E4E0 Relevance: 84.2, APIs: 36, Strings: 11, Instructions: 1962COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF76D64E56F

Strings

ios_base::badbit set, xrefs: 00007FF76D650B51
ios_base::eofbit set, xrefs: 00007FF76D650B64
" --type , xrefs: 00007FF76D64FFC1
ios_base::failbit set, xrefs: 00007FF76D650B5D
status, xrefs: 00007FF76D650B27
APPB:, xrefs: 00007FF76D6503E2
, xrefs: 00007FF76D64E5BE
cmd /c "", xrefs: 00007FF76D64FF69
--key ", xrefs: 00007FF76D65002E
File.exe, xrefs: 00007FF76D64FA9B
6, xrefs: 00007FF76D64F68D

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: FileModuleName
String ID: $ --key "$" --type $APPB:$File.exe$cmd /c ""$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$status$6
API String ID: 514040917-1525073170
Opcode ID: fc81f2bb7d1c1a65adef5553010c1d07be3fd6c174a5f1a4ed69ab811980d5f5
Instruction ID: 45efc94292c639f2259578d40a3266a511e58624d5d95cbd7a100f554c97877f
Opcode Fuzzy Hash: fc81f2bb7d1c1a65adef5553010c1d07be3fd6c174a5f1a4ed69ab811980d5f5
Instruction Fuzzy Hash: B5238372E29BC5C9DB609F29E8443EDA361FB85798F405235EA9D07B99EF78D180C310

Function 00007FF76D679310 Relevance: 59.9, APIs: 33, Strings: 1, Instructions: 374
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00007FF76D67935C
GetSystemMetrics.USER32 ref: 00007FF76D67936A
GetSystemMetrics.USER32 ref: 00007FF76D679378
GetSystemMetrics.USER32 ref: 00007FF76D679386
GetDC.USER32 ref: 00007FF76D679390
GetDeviceCaps.GDI32 ref: 00007FF76D6793A6
GetDeviceCaps.GDI32 ref: 00007FF76D6793B6
CreateCompatibleDC.GDI32 ref: 00007FF76D6793C3
CreateCompatibleBitmap.GDI32 ref: 00007FF76D6793DB
SelectObject.GDI32 ref: 00007FF76D6793F1
BitBlt.GDI32 ref: 00007FF76D679427
SHCreateMemStream.SHLWAPI ref: 00007FF76D67944D
SelectObject.GDI32 ref: 00007FF76D679467
DeleteDC.GDI32 ref: 00007FF76D679470
ReleaseDC.USER32 ref: 00007FF76D67947B
DeleteObject.GDI32 ref: 00007FF76D679484
EnterCriticalSection.KERNEL32 ref: 00007FF76D67957B
LeaveCriticalSection.KERNEL32 ref: 00007FF76D679588
GetObjectW.GDI32 ref: 00007FF76D6795A4
IStream_Size.SHLWAPI ref: 00007FF76D67964F
IStream_Reset.SHLWAPI ref: 00007FF76D67965F
IStream_Read.SHLWAPI ref: 00007FF76D6796C0
SelectObject.GDI32 ref: 00007FF76D67970F
DeleteDC.GDI32 ref: 00007FF76D679718
ReleaseDC.USER32 ref: 00007FF76D679725
DeleteObject.GDI32 ref: 00007FF76D67972E
DeleteObject.GDI32 ref: 00007FF76D679838
EnterCriticalSection.KERNEL32 ref: 00007FF76D67984A
EnterCriticalSection.KERNEL32 ref: 00007FF76D67985A
GdiplusShutdown.GDIPLUS ref: 00007FF76D679868
LeaveCriticalSection.KERNEL32 ref: 00007FF76D679875
LeaveCriticalSection.KERNEL32 ref: 00007FF76D67987F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6798C3

Strings

, xrefs: 00007FF76D6793FC

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Object$CriticalSection$Delete$MetricsSystem$CreateEnterLeaveSelectStream_$CapsCompatibleDeviceRelease$BitmapGdiplusReadResetShutdownSizeStream_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1635401455-3916222277
Opcode ID: b5f24d296b0fa790928331ca9ed313377f52b33d4ae334aa395d37e96a61b700
Instruction ID: 2b4d659568b778c87d8d84fcda4fe66a392363842fd3c7409cc965f8b3560046
Opcode Fuzzy Hash: b5f24d296b0fa790928331ca9ed313377f52b33d4ae334aa395d37e96a61b700
Instruction Fuzzy Hash: 7C027072A28B81CAE720DF75D8442A9B3A2FB497D8F904236EA5D47B58EF3CD444C710

Function 00007FF76D64BAF0 Relevance: 54.6, APIs: 22, Strings: 8, Instructions: 2081COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D61EEB0: __std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF76D61EF2E
Part of subcall function 00007FF76D61EEB0: __std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF76D61EF6A

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E288
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E28E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E294
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E29A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E2EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E30D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E313
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E329
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E32F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D64E335
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E38C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E392
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E3E7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E3ED
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E3F3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E409
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E40F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D64E415
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E472
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E4C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64E4CD

Part of subcall function 00007FF76D630AC0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D630B94

Part of subcall function 00007FF76D631A80: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D631B80
Part of subcall function 00007FF76D631A80: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D631B8C

Strings

recursive_directory_iterator::recursive_directory_iterator, xrefs: 00007FF76D64E3BD, 00007FF76D64E49D
content, xrefs: 00007FF76D64C5E4, 00007FF76D64D0CE, 00007FF76D64DCC8
status, xrefs: 00007FF76D64E2D7, 00007FF76D64E31C, 00007FF76D64E3FC
filename, xrefs: 00007FF76D64C4ED, 00007FF76D64CFD8, 00007FF76D64DBD2
exists, xrefs: 00007FF76D64E2B0, 00007FF76D64E300, 00007FF76D64E3DA, 00007FF76D64E4BA
recursive_directory_iterator::operator++, xrefs: 00007FF76D64E3A6, 00007FF76D64E486
cannot use push_back() with , xrefs: 00007FF76D64E34D, 00007FF76D64E42D
directory_iterator::directory_iterator, xrefs: 00007FF76D64E2C7

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$__std_fs_convert_wide_to_narrow
String ID: cannot use push_back() with $content$directory_iterator::directory_iterator$exists$filename$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 972399972-4250644884
Opcode ID: b425a50d82dcc6c52e39234fdad33192eaad0e5e086318b9b7a9dfd40cb98d37
Instruction ID: c7d1eb88ad3967f0d346d23c775f69df8e125be4754c9ae3e9432e69cbe35d9e
Opcode Fuzzy Hash: b425a50d82dcc6c52e39234fdad33192eaad0e5e086318b9b7a9dfd40cb98d37
Instruction Fuzzy Hash: 27235E62A2DBC2C1DA30EB14E4543EAB362FBC5794F849236D68D43A99EF7CD144CB50

Function 00007FF76D67BA60 Relevance: 50.4, APIs: 19, Strings: 9, Instructions: 1387
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF76D679EF0: EnumDisplayDevicesW.USER32 ref: 00007FF76D679F49

Part of subcall function 00007FF76D679E20: RegGetValueA.KERNEL32 ref: 00007FF76D679E87

Part of subcall function 00007FF76D679A60: GetUserNameW.ADVAPI32 ref: 00007FF76D679AA5

Part of subcall function 00007FF76D679B00: GetComputerNameW.KERNEL32 ref: 00007FF76D679B45

Part of subcall function 00007FF76D630AC0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D630B94

GlobalMemoryStatusEx.KERNEL32 ref: 00007FF76D67BF16
wcsftime.LIBCMT ref: 00007FF76D67C78F
GetModuleFileNameA.KERNEL32 ref: 00007FF76D67C951
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3B9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3BF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3C5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3CB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3D7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3DD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3E3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3E9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3EF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3F5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D3FB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D401
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67D407

Strings

gpu, xrefs: 00007FF76D67BCC0
%d-%m-%Y, %H:%M:%S, xrefs: 00007FF76D67C77C
cpu, xrefs: 00007FF76D67BDD6
time, xrefs: 00007FF76D67C877
user_name, xrefs: 00007FF76D67BBB0
ram, xrefs: 00007FF76D67C003
computer_name, xrefs: 00007FF76D67C107
system, xrefs: 00007FF76D67BB5C, 00007FF76D67BC6C, 00007FF76D67BD82, 00007FF76D67BE74, 00007FF76D67BFAF, 00007FF76D67C0B1, 00007FF76D67C1B4, 00007FF76D67C356, 00007FF76D67C572, 00007FF76D67C823, 00007FF76D67CA00, 00007FF76D67CC4C, 00007FF76D67CE05, 00007FF76D67CFC3, 00007FF76D67D082
timezone, xrefs: 00007FF76D67CCA0

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Name$ComputerDevicesDisplayEnumFileGlobalMemoryModuleStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 3508509583-1182675529
Opcode ID: 33fd77bb17ad21160df8aa85449941a91be0ba10db99b9be6800edfbca8bac3c
Instruction ID: eb1a3b7d43b4c2745b08f4b95cbc751759b4a491479f0a683e12ba18baf2fa5d
Opcode Fuzzy Hash: 33fd77bb17ad21160df8aa85449941a91be0ba10db99b9be6800edfbca8bac3c
Instruction Fuzzy Hash: 15E28122A28BC5C9D720DF35E8402ED7762FB85788F909635DA8D47B99EF78D284C710

Function 00007FF76D6677F0 Relevance: 39.1, APIs: 18, Strings: 4, Instructions: 585
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

APPB:, xrefs: 00007FF76D667F62
--type, xrefs: 00007FF76D667E21
--key, xrefs: 00007FF76D667D8B, 00007FF76D667EE9
1.0, xrefs: 00007FF76D667C8B

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID: --key$--type$1.0$APPB:
API String ID: 0-155154914
Opcode ID: 37530bec965e337c4374fe987a11795c6172ab59ef2ccda900970f72c56cccd3
Instruction ID: 932ab3ad39a7629202e49648f6b6fbd33f635758eb7a37560dbf22a270e91cae
Opcode Fuzzy Hash: 37530bec965e337c4374fe987a11795c6172ab59ef2ccda900970f72c56cccd3
Instruction Fuzzy Hash: 2D429232E2CAC6D1EA14EB65E4503EEE362FB857C0F805135D68D13A9AEF7CE4948711

Function 00007FF76D62D510 Relevance: 35.9, APIs: 17, Strings: 3, Instructions: 864
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 00007FF76D62D5ED
GetProcAddress.KERNEL32 ref: 00007FF76D62D6EB
GetProcAddress.KERNEL32 ref: 00007FF76D62D7AF
GetProcAddress.KERNEL32 ref: 00007FF76D62D82A
GetProcAddress.KERNEL32 ref: 00007FF76D62D8AF
GetProcAddress.KERNEL32 ref: 00007FF76D62D92A
GetProcAddress.KERNEL32 ref: 00007FF76D62D9AF
FreeLibrary.KERNEL32 ref: 00007FF76D62E4D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62E50E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62E566
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62E56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62E572
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62E578
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62E57E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62E584
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62E58A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62E590

Strings

system, xrefs: 00007FF76D62E2DB
cannot use push_back() with , xrefs: 00007FF76D62E52A
vault, xrefs: 00007FF76D62E32F

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2463004387-1741236777
Opcode ID: 1ea414b87033da06aa110d05bf6cdcd166eecbfa065522dcbb495f8999a22835
Instruction ID: b11bedcfc6b139c8a517c251e13b484493c84ab336d3d11c7de0c4f8fff5ba9a
Opcode Fuzzy Hash: 1ea414b87033da06aa110d05bf6cdcd166eecbfa065522dcbb495f8999a22835
Instruction Fuzzy Hash: 72926B32A19BC58ADB609F25E8403EDB3B5F789798F504235EA9C57B99EF78C244C700

Function 00007FF76D651A80 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 571
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

prefs.js, xrefs: 00007FF76D652FB8
status, xrefs: 00007FF76D652828, 00007FF76D65284A, 00007FF76D652872, 00007FF76D65289A
exists, xrefs: 00007FF76D651A64, 00007FF76D653E7C
cannot use push_back() with , xrefs: 00007FF76D6527E9
directory_iterator::directory_iterator, xrefs: 00007FF76D65283A, 00007FF76D653E93

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: baa696ad5cd76eb19276f8acb3fb410db83ae414b653db0f685a07237c69f330
Instruction ID: 072187c270283e1d6477932d5a4b08be30cda009e3698a46eb6c1d7ee1b9e987
Opcode Fuzzy Hash: baa696ad5cd76eb19276f8acb3fb410db83ae414b653db0f685a07237c69f330
Instruction Fuzzy Hash: 9952483291DBC5C4E671AB15E8813EAB3A5FB89784F805235DACC42B59EF7CD184CB50

Function 00007FF76D6AC138 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FF76D6AC1E5
GetLastError.KERNEL32 ref: 00007FF76D6AC1EF
FindFirstFileW.KERNEL32 ref: 00007FF76D6AC206
GetLastError.KERNEL32 ref: 00007FF76D6AC212
FindClose.KERNEL32 ref: 00007FF76D6AC220
__std_fs_open_handle.LIBCPMT ref: 00007FF76D6AC2B3
CloseHandle.KERNEL32 ref: 00007FF76D6AC2C9
CloseHandle.KERNEL32 ref: 00007FF76D6AC43C

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: d61a8205c22dd417f485a3e9fb419a33c3a905dc4861a856e94f2a43c5fae776
Instruction ID: 38b545287858587de28a5881a97082ff7aa8f03c16fdce1e9fe9ade098befb2d
Opcode Fuzzy Hash: d61a8205c22dd417f485a3e9fb419a33c3a905dc4861a856e94f2a43c5fae776
Instruction Fuzzy Hash: A3918535F2CA03C6E674AB15A814679A392AF557F0F9D0330D9BE47AD4EE3CE8018660

Function 00007FF76D621D4E Relevance: 27.1, APIs: 10, Strings: 5, Instructions: 804
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

content, xrefs: 00007FF76D62244D
status, xrefs: 00007FF76D622A80, 00007FF76D622A96
filename, xrefs: 00007FF76D622396
exists, xrefs: 00007FF76D622A54
directory_iterator::directory_iterator, xrefs: 00007FF76D622A70, 00007FF76D622ABA

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 0-3429737954
Opcode ID: f72b44e5f63ad384debeb5166e6e59b33fc48c263dc904b0b84a5255a8d13743
Instruction ID: fa2c19993cbd121633c144ce9ecce7e3716f122bc491612db4154351d1499327
Opcode Fuzzy Hash: f72b44e5f63ad384debeb5166e6e59b33fc48c263dc904b0b84a5255a8d13743
Instruction Fuzzy Hash: 1A828222E29BC6C5EB20EF25D8843ED6362FB89794F845231DA4D47A99FF78D644C310

Function 00007FF76D62C9C0 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 668
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CredEnumerateA.ADVAPI32 ref: 00007FF76D62CA22
CredFree.ADVAPI32 ref: 00007FF76D62D434
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62D46A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62D4BC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62D4C2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62D4C8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62D4CE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62D4D4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62D4DA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62D4E0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62D4E6

Strings

cannot use push_back() with , xrefs: 00007FF76D62D480

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 1347986415-4122110429
Opcode ID: 313090f729bf93b01659435f84f566bce3f38d1441092de9202f4dc5bf61f37a
Instruction ID: 3450fc12f554e7ad75be74d398fcc528fc31d984ca78bac7b1fa83752fda630b
Opcode Fuzzy Hash: 313090f729bf93b01659435f84f566bce3f38d1441092de9202f4dc5bf61f37a
Instruction Fuzzy Hash: 0F627032A18BC5C9E7209F25E8403ED7762FB89798F905335DAAD07A99EF78D184C710

Function 00007FF76D682150 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 421
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF76D682300
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF76D68230E
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF76D68259D
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF76D6825AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D682753
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D682759
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D68277C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D682782
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D682788
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6827AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6827B1

Strings

value, xrefs: 00007FF76D682226, 00007FF76D6824CD

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_destroy
String ID: value
API String ID: 1346393832-494360628
Opcode ID: febe89cee9fabced139ff552026d4de5017502df10622a41fb6033d7a37dffde
Instruction ID: 81486ae9f73c1253c29bd350c89814fbea51721cd9bf1302b8d319221834ee6a
Opcode Fuzzy Hash: febe89cee9fabced139ff552026d4de5017502df10622a41fb6033d7a37dffde
Instruction Fuzzy Hash: B712A722E2CBC1C5EB10DB75D4443ADA762EB997E4F945331EA9D02AD9EF6CD184C320

Function 00007FF76D678210 Relevance: 19.9, APIs: 13, Instructions: 431
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recv.WS2_32 ref: 00007FF76D6783EE
recv.WS2_32 ref: 00007FF76D678909
closesocket.WS2_32 ref: 00007FF76D67891B
WSACleanup.WS2_32 ref: 00007FF76D678921
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A43

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$recv$Cleanupclosesocket
String ID:
API String ID: 3402187201-0
Opcode ID: 7e02839f8e8191f0211a094e47d185844e52548a3a89fb8f6b96793e82fcd201
Instruction ID: f1433760a34ed470119c7343f6bbb70c99e2e36ece2360dd749bf492eaf7c097
Opcode Fuzzy Hash: 7e02839f8e8191f0211a094e47d185844e52548a3a89fb8f6b96793e82fcd201
Instruction Fuzzy Hash: 59127172E2CBC5C0EA20EB15E4443EAA762FB997D0F904631D69C02AE9EF7CD484C710

Function 00007FF76D678A50 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 377
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 00007FF76D678C82

Part of subcall function 00007FF76D6A53D0: EnterCriticalSection.KERNEL32(?,?,0000000100000000,00007FF76D621944), ref: 00007FF76D6A53E0

InternetOpenUrlA.WININET ref: 00007FF76D678CF2
HttpQueryInfoW.WININET ref: 00007FF76D678D4A
HttpQueryInfoW.WININET ref: 00007FF76D678DD3
InternetQueryDataAvailable.WININET ref: 00007FF76D678E11
InternetReadFile.WININET ref: 00007FF76D678ECB
InternetQueryDataAvailable.WININET ref: 00007FF76D678F91
InternetCloseHandle.WININET ref: 00007FF76D679031
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67906B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D679071

Strings

`;b, xrefs: 00007FF76D678B16

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskCriticalEnterFileHandleReadSection_invalid_parameter_noinfo_noreturn
String ID: `;b
API String ID: 2754876294-2329670205
Opcode ID: fac61afa368332affd44006f306dcaf430422c897361d7a3e192ef2638905564
Instruction ID: 7e5fe1abcb40353e7ef1bf9951bc599795284d193365497ee4c07c263fd20afa
Opcode Fuzzy Hash: fac61afa368332affd44006f306dcaf430422c897361d7a3e192ef2638905564
Instruction Fuzzy Hash: AC028C32E28B95C5F700DB65E8406ADB7A6FB84798F501235EE8D57B98EF38D480C750

Function 00007FF76D62E5A0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 324
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF76D62E5E8
Process32FirstW.KERNEL32 ref: 00007FF76D62E62A
Process32NextW.KERNEL32 ref: 00007FF76D62E829
CloseHandle.KERNEL32 ref: 00007FF76D62EA9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62EB34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62EB3A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62EB40
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62EB46

Strings

[PID: , xrefs: 00007FF76D62E664

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 1946380282-2210602247
Opcode ID: 2e98722eda0985c94e24bd3d9f72c1d81085f42899550c162b2b0af844e38f11
Instruction ID: fe15c2c408be0bf75a717df4aa27af260bdd0c90d1c6de6926acf7737381a8ab
Opcode Fuzzy Hash: 2e98722eda0985c94e24bd3d9f72c1d81085f42899550c162b2b0af844e38f11
Instruction Fuzzy Hash: 50E19472A28BC185E720DF25E8803EDB766F784794F804235EA9D47B99EF78D284C710

Function 00007FF76D62EC50 Relevance: 15.7, APIs: 10, Instructions: 716COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62FA19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62FA1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62FA25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62FA2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62FA31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62FA37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62FA3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62FA43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62FA49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62FA4F

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 6788cebbe8b05759457b1506817ae21ad95c6f4b341e056836f9150a18ed290e
Instruction ID: 11d7321f56201350c4e5a8a911bbb01172b64f8ae041d22fceeb6729a49196b0
Opcode Fuzzy Hash: 6788cebbe8b05759457b1506817ae21ad95c6f4b341e056836f9150a18ed290e
Instruction Fuzzy Hash: A9724E32A18BC5C9DB309F29E8403ED63A5F788798F505335EA9C56B99EF78D284C710

Function 00007FF76D671F20 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 452fileCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32 ref: 00007FF76D67213F
SetFilePointer.KERNEL32 ref: 00007FF76D6721F2
ReadFile.KERNEL32 ref: 00007FF76D672221
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6726B3

Strings

ios_base::badbit set, xrefs: 00007FF76D6726CD, 00007FF76D6726F5
ios_base::eofbit set, xrefs: 00007FF76D672708
ios_base::failbit set, xrefs: 00007FF76D672701
exists, xrefs: 00007FF76D6726A6

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: File$PointerReadSize_invalid_parameter_noinfo_noreturn
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2478245620-15404121
Opcode ID: d8da539ebf60621fe167a0c0dfa5e5e9ad05ba32cf1afa242e7554c68b68d236
Instruction ID: 203f844cfece491dadca438cd79197a54cd8a5cf430d7f40b0e136d574c5e9d2
Opcode Fuzzy Hash: d8da539ebf60621fe167a0c0dfa5e5e9ad05ba32cf1afa242e7554c68b68d236
Instruction Fuzzy Hash: 3F322A22A28BC5C9EB20DF28D8903ED77A2FB44788F844236DA8D57B59EF78D554C710

Function 00007FF76D699D08 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF76D699D4D

Part of subcall function 00007FF76D6993B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6993CC

Part of subcall function 00007FF76D694454: RtlFreeHeap.NTDLL(?,?,?,00007FF76D69E5C2,?,?,?,00007FF76D69E93F,?,?,00000000,00007FF76D69C67C,?,?,?,00007FF76D69C5AF), ref: 00007FF76D69446A
Part of subcall function 00007FF76D694454: GetLastError.KERNEL32(?,?,?,00007FF76D69E5C2,?,?,?,00007FF76D69E93F,?,?,00000000,00007FF76D69C67C,?,?,?,00007FF76D69C5AF), ref: 00007FF76D694474

Part of subcall function 00007FF76D688D58: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF76D688D06,?,?,?,?,8000000000000000,00007FF76D688BEE), ref: 00007FF76D688D61
Part of subcall function 00007FF76D688D58: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF76D688D06,?,?,?,?,8000000000000000,00007FF76D688BEE), ref: 00007FF76D688D86

Part of subcall function 00007FF76D6A2470: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6A23BB

_get_daylight.LIBCMT ref: 00007FF76D699D3C

Part of subcall function 00007FF76D699418: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D69942C

_get_daylight.LIBCMT ref: 00007FF76D699FB2
_get_daylight.LIBCMT ref: 00007FF76D699FC3
_get_daylight.LIBCMT ref: 00007FF76D699FD4
GetTimeZoneInformation.KERNEL32(00007FF76D69A2C2), ref: 00007FF76D699FFB

Strings

Eastern Summer Time, xrefs: 00007FF76D69A0B9
Eastern Standard Time, xrefs: 00007FF76D69A0A1

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 7f3e2c6d8f544dcf824fc2204b4da78a5b48d0e44cc0b0bd3589fe12c5d04071
Instruction ID: d5c2469596fd906630cd7e5071da3496fcdec2123821037127debb83c7905f6d
Opcode Fuzzy Hash: 7f3e2c6d8f544dcf824fc2204b4da78a5b48d0e44cc0b0bd3589fe12c5d04071
Instruction Fuzzy Hash: F4D1A326E2C643CAEB20BF25D4505B9A3A3EF447C8F845136DA5D4BA95FF3CE8418760

Function 00007FF76D696504 Relevance: 10.8, APIs: 7, Instructions: 286COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D696936

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6af02b40caf86ad04c16c058bb45c72eaa5f81482c5d575273d1da7d3666781d
Instruction ID: 3853076151d177b35089934ed12fe47c0ec7b6151b2b199f3bdd943c29376a82
Opcode Fuzzy Hash: 6af02b40caf86ad04c16c058bb45c72eaa5f81482c5d575273d1da7d3666781d
Instruction Fuzzy Hash: 5FC1B122E2C787D5EB607B5194403B9A793EF81BD0F844175EA4E0B295EE7CE85487B0

Function 00007FF76D699F84 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF76D699FB2

Part of subcall function 00007FF76D699418: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D69942C

_get_daylight.LIBCMT ref: 00007FF76D699FC3

Part of subcall function 00007FF76D6993B8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6993CC

_get_daylight.LIBCMT ref: 00007FF76D699FD4

Part of subcall function 00007FF76D6993E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6993FC

Part of subcall function 00007FF76D694454: RtlFreeHeap.NTDLL(?,?,?,00007FF76D69E5C2,?,?,?,00007FF76D69E93F,?,?,00000000,00007FF76D69C67C,?,?,?,00007FF76D69C5AF), ref: 00007FF76D69446A
Part of subcall function 00007FF76D694454: GetLastError.KERNEL32(?,?,?,00007FF76D69E5C2,?,?,?,00007FF76D69E93F,?,?,00000000,00007FF76D69C67C,?,?,?,00007FF76D69C5AF), ref: 00007FF76D694474

GetTimeZoneInformation.KERNEL32(00007FF76D69A2C2), ref: 00007FF76D699FFB

Strings

Eastern Summer Time, xrefs: 00007FF76D69A0B9
Eastern Standard Time, xrefs: 00007FF76D69A0A1

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: be1835f9fd9397b4c0447581b518a2abff0f58810eff9969caeeccc32c0612b5
Instruction ID: 56da5057d8df31b9995d26bce5e325359e61fc9c3d8f7f34a3c8265aa2eb4e88
Opcode Fuzzy Hash: be1835f9fd9397b4c0447581b518a2abff0f58810eff9969caeeccc32c0612b5
Instruction Fuzzy Hash: F7514132E2C643C6E710FF25D4909A9A7A3BB487C4F845136DA5D47A95EF3CE8418760

Function 00007FF76D679FB0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67A368
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67A36E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67A374
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67A37A

Strings

cores, xrefs: 00007FF76D67A1E6

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: cores
API String ID: 3668304517-2370456839
Opcode ID: 5a56a27a6a12292f8f056ae5051b58c18cb399631a994091f64dc84101bfa3dc
Instruction ID: 776243d1ef6e9e1d84831b4a02b1e1605a9ef099779660e457dca84b3be67b3a
Opcode Fuzzy Hash: 5a56a27a6a12292f8f056ae5051b58c18cb399631a994091f64dc84101bfa3dc
Instruction Fuzzy Hash: 7CB1A362F28B85CAF700DFB8D0413AC7372AB55398FA05335DE5C22A9AEB789195C350

Function 00007FF76D673360 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 428COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D6A53D0: EnterCriticalSection.KERNEL32(?,?,0000000100000000,00007FF76D621944), ref: 00007FF76D6A53E0

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D673BAE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D673BB4

Strings

ios_base::badbit set, xrefs: 00007FF76D673BCF, 00007FF76D673C0C, 00007FF76D673C4A
exists, xrefs: 00007FF76D673C83

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CriticalEnterSection
String ID: exists$ios_base::badbit set
API String ID: 555700303-2074760687
Opcode ID: 211bf8ed80172411212655d15e50f84c739a6300d7cc6cbddb125a93418e7dca
Instruction ID: e9524da3d512c8d857fe4ddd963c4bf406aef357ed1f393164436afac11e4d8c
Opcode Fuzzy Hash: 211bf8ed80172411212655d15e50f84c739a6300d7cc6cbddb125a93418e7dca
Instruction Fuzzy Hash: F3324332E2DBC5D5DA21EB14E4903EAB366FB94780F804235DA9D43AA9EF7CD144CB10

Function 00007FF76D620BD0 Relevance: 4.8, APIs: 3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47db54cdc77b99b8a0aea0f1502c255d51c94eec2d03ff0ce8315311750e19c0
Instruction ID: a910e11b206a86a9008fb6d29d796a03809cb7c9c107577c18ff0f35b794942c
Opcode Fuzzy Hash: 47db54cdc77b99b8a0aea0f1502c255d51c94eec2d03ff0ce8315311750e19c0
Instruction Fuzzy Hash: 74F16032A18F8889EB208B69E44139DB7B1F789798F504325EEDC57B98EF7CD1808700

Function 00007FF76D6212C0 Relevance: 4.8, APIs: 3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013e423ae74e6ac55b6184ae608de63b910e93e29112b48b6cf5f6059d3d39fa
Instruction ID: 3a253e26140bf65c92606ef666fcd0aa1e299827d2c0dd517aa91b62d8fdf3c7
Opcode Fuzzy Hash: 013e423ae74e6ac55b6184ae608de63b910e93e29112b48b6cf5f6059d3d39fa
Instruction Fuzzy Hash: B2F13E32A18F8889EB208B69E44139DB7B1F789798F505325EEDC57B99EF7CD1908700

Function 00007FF76D67AB00 Relevance: 4.7, APIs: 3, Instructions: 160COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 00007FF76D67AB71
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67AD96
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67AD9C

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$DriveLogicalStrings
String ID:
API String ID: 3916208290-0
Opcode ID: 8df1d4c67eb389f700f34094b18bd9600d27059f3efc52be58bca253bad1cae3
Instruction ID: 98234e1c6fc9d4cba1836e582eebe3e58fd7ab774fe8c54dc73f0d0bb4db1492
Opcode Fuzzy Hash: 8df1d4c67eb389f700f34094b18bd9600d27059f3efc52be58bca253bad1cae3
Instruction Fuzzy Hash: E9715E32E2CB85C2E7109B24E4803ADB765FB94798F545225EA9C13AA9EF7CE1D0D740

Function 00007FF76D67ADB0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 00007FF76D67B0F5

Strings

[UTC, xrefs: 00007FF76D67B0C2

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: InformationTimeZone
String ID: [UTC
API String ID: 565725191-1715286942
Opcode ID: 32cfad913eb78652faaf34ab0dc984f513f5d8a2433cb94acb5931d164039b4a
Instruction ID: 9404dc42c75488dd723a2b342bfb91ebdb2794d01cb81fa2f147b8061be2b03c
Opcode Fuzzy Hash: 32cfad913eb78652faaf34ab0dc984f513f5d8a2433cb94acb5931d164039b4a
Instruction Fuzzy Hash: A091D832A19FC889D7708F29E84129AB7A5F789788F505325EACD57B19EF38C250CB40

Function 00007FF76D661CF0 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FF76D661D48
LocalFree.KERNEL32 ref: 00007FF76D661DDA

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: f88957cfd2b51bcb633bef7ba602987a2d0c6455c83a8ba819920da39e749fc3
Instruction ID: 278f32791aa13c25166538c6272ee1904aa1725cde26d16f137b626795e7b607
Opcode Fuzzy Hash: f88957cfd2b51bcb633bef7ba602987a2d0c6455c83a8ba819920da39e749fc3
Instruction Fuzzy Hash: 1A418B32A28B81CAE3209F74E4403ED77A5FB5978CF444235EA8C12E8AEF79D164C354

Function 00007FF76D679A60 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00007FF76D679AA5

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 90496fcf6dfcee039494cb4054596e234e531b545ff591467ece2fe3a88e0abf
Instruction ID: 12bda5a29ebfc093854fd296f40821f916515df94fdd8ae1b3913586bbdaaec0
Opcode Fuzzy Hash: 90496fcf6dfcee039494cb4054596e234e531b545ff591467ece2fe3a88e0abf
Instruction Fuzzy Hash: F901523292C681C2D720DF15F5003AAA3A1FB987C8F940131E68D42659EFBCD1908B40

Function 00007FF76D680A90 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

\u%04x, xrefs: 00007FF76D680C86

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID: \u%04x
API String ID: 0-2916071157
Opcode ID: 1fad9b3796bb0d5fdcf9dafeee4abe8aa7886122a64dabba2bcf5863bcbe4c67
Instruction ID: e2882054164e16216ab5909f7bfb3b257ea925d695239955d2fbc7ce995a6fc3
Opcode Fuzzy Hash: 1fad9b3796bb0d5fdcf9dafeee4abe8aa7886122a64dabba2bcf5863bcbe4c67
Instruction Fuzzy Hash: 56910262E1D682C2EB54EF26D4902ADA762FB85BC4F849431DB4E03B91EF7CE515C320

Function 00007FF76D6800A8 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

": , xrefs: 00007FF76D680185, 00007FF76D680225

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID: ":
API String ID: 0-3662656813
Opcode ID: b9b08ee33fba6464ba4a034b66aaf27c00bb5b847e315b820d08c0993251eba8
Instruction ID: 888c95bbcc2a6c9cee8f9246fceb3be946ef212cc68e98acabe658e0d3576a02
Opcode Fuzzy Hash: b9b08ee33fba6464ba4a034b66aaf27c00bb5b847e315b820d08c0993251eba8
Instruction Fuzzy Hash: DE911676619A46C1DB10EF2AE09466DA762FB88FC8F859022CF5E07B64DF39D158C710

Function 00007FF76D6340B0 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF76D634139

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: 437ae662eb117c41f44ff7f9c77615c2854eafd9d66bebc79b763ab490802efe
Instruction ID: 93610bed24222183f9663bd486d6c8f5b081c9a2526016635dcefc9ce8ade991
Opcode Fuzzy Hash: 437ae662eb117c41f44ff7f9c77615c2854eafd9d66bebc79b763ab490802efe
Instruction Fuzzy Hash: D4412663A2D7E08AD702CB39841127DBFB2E366B88B1DC172D7D887746DA6DD206C710

Function 00007FF76D671B00 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF76D671970: InitializeCriticalSectionEx.KERNEL32 ref: 00007FF76D6719C1
Part of subcall function 00007FF76D671970: GetLastError.KERNEL32 ref: 00007FF76D6719CB

EnterCriticalSection.KERNEL32 ref: 00007FF76D671B41
GdiplusStartup.GDIPLUS ref: 00007FF76D671B68
LeaveCriticalSection.KERNEL32 ref: 00007FF76D671B76
LeaveCriticalSection.KERNEL32 ref: 00007FF76D671BA4
GdipGetImageEncodersSize.GDIPLUS ref: 00007FF76D671BB2
GdipGetImageEncoders.GDIPLUS ref: 00007FF76D671C46
GdipCreateBitmapFromScan0.GDIPLUS ref: 00007FF76D671D0A
GdipSaveImageToStream.GDIPLUS ref: 00007FF76D671D28
GdipDisposeImage.GDIPLUS ref: 00007FF76D671D8D
GdipDisposeImage.GDIPLUS ref: 00007FF76D671DA1

Strings

&, xrefs: 00007FF76D671D04

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: a799f0d6590f995dc081d60b5774d6bb27e4fbd63746d95bb83c1d8aad6cf0fd
Instruction ID: 45e73b2b3dcc4ac0f3f6a3625584316a7bca2964135f2d52ad85a6bd885c9247
Opcode Fuzzy Hash: a799f0d6590f995dc081d60b5774d6bb27e4fbd63746d95bb83c1d8aad6cf0fd
Instruction Fuzzy Hash: D591C432E2CB46CAE720EF21E8105A8B3A2FB54BD8B845136DA4D47B94EF3CE555C750

Function 00007FF76D673030 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 193
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF76D679080: GetUserGeoID.KERNEL32 ref: 00007FF76D6790A5
Part of subcall function 00007FF76D679080: GetGeoInfoA.KERNEL32 ref: 00007FF76D6790BD
Part of subcall function 00007FF76D679080: GetGeoInfoA.KERNEL32 ref: 00007FF76D67910D

Part of subcall function 00007FF76D630AC0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D630B94

WSAStartup.WS2_32 ref: 00007FF76D67313C
socket.WS2_32 ref: 00007FF76D673157
htons.WS2_32 ref: 00007FF76D673178
inet_pton.WS2_32 ref: 00007FF76D6731A5
connect.WS2_32 ref: 00007FF76D6731BD
closesocket.WS2_32 ref: 00007FF76D6731D3
WSACleanup.WS2_32 ref: 00007FF76D6731D9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67334B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D673351
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D673357

Strings

geo, xrefs: 00007FF76D6730E9
system, xrefs: 00007FF76D6730AA

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 2440148987-2364779556
Opcode ID: f9b9bf502d635d518ba8d4ea29e5bdb740b61dcfc69bba0197c85f47a6f257a1
Instruction ID: 862c5565c07e5671209f7fe9fdf2032e2a39c728d1a8333ce2284c0e56786f62
Opcode Fuzzy Hash: f9b9bf502d635d518ba8d4ea29e5bdb740b61dcfc69bba0197c85f47a6f257a1
Instruction Fuzzy Hash: 6D917E62F2CA46C9EB00EB64E4501EC7373EB443D8F805636DA6D12AA9FE7CE549C310

Function 00007FF76D67B136 Relevance: 16.9, APIs: 11, Instructions: 377
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67B700
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67B706
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67B70C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67B712
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67B718
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67B71E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67B724
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67B72A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67B730
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67B736
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67B73C

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 4ecf03b484961b4e3d84f576676e6ba032df54f9d8a594d07bc2a7ae52410360
Instruction ID: 61a3f72d4d473d416605d70dafbb378675539414ddfb89d909365918423c0d65
Opcode Fuzzy Hash: 4ecf03b484961b4e3d84f576676e6ba032df54f9d8a594d07bc2a7ae52410360
Instruction Fuzzy Hash: F5F17762E287C5C5EB10DB39D4453ADA722EB957E4F909331DAAC06ADAEF7CD1C08350

Function 00007FF76D6514C0 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D651836
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D65183C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D651842
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D651848

Strings

key, xrefs: 00007FF76D651015, 00007FF76D651142
chrome_key, xrefs: 00007FF76D651266, 00007FF76D651388
status, xrefs: 00007FF76D6514A0
exists, xrefs: 00007FF76D65147D, 00007FF76D651814, 00007FF76D651829
directory_iterator::directory_iterator, xrefs: 00007FF76D651490

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: chrome_key$directory_iterator::directory_iterator$exists$key$status
API String ID: 3668304517-2866355200
Opcode ID: 08b92d76e2e3f11f03edf2e011446b00a9d06c3c12f3ffdb4d37cbbd82b36e5f
Instruction ID: 65201cd25af4e54b0dc7d01dedeffc32fd850ffda7a04ac36af76a28d93f7cea
Opcode Fuzzy Hash: 08b92d76e2e3f11f03edf2e011446b00a9d06c3c12f3ffdb4d37cbbd82b36e5f
Instruction Fuzzy Hash: 8CA18472E28B86C5EB10EF28E8442AD7362FB447D8F905635EA5D07A99EF7CD181C710

Function 00007FF76D660390 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 118COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D66054D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D660553
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D660559
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D66055F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D660565

Strings

QAH3HKAu0+BYhcT7vSH07CMO3LWM4XxPLt3kmwYOIVE=, xrefs: 00007FF76D6606CC
type must be number, but is , xrefs: 00007FF76D6615EC, 00007FF76D661693
zNuHWZk7sUY=, xrefs: 00007FF76D660754
port, xrefs: 00007FF76D6611BC

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: QAH3HKAu0+BYhcT7vSH07CMO3LWM4XxPLt3kmwYOIVE=$port$type must be number, but is $zNuHWZk7sUY=
API String ID: 3668304517-3400936290
Opcode ID: 7d82c991707c4129d014f9c2bf4edb22411221f1a20e94ed221207c3070c9aca
Instruction ID: a7dc44eb88fa84fc29dd8bb43fa99aaca7832de569ecc0a03c260ef9ffb8e2c4
Opcode Fuzzy Hash: 7d82c991707c4129d014f9c2bf4edb22411221f1a20e94ed221207c3070c9aca
Instruction Fuzzy Hash: 7B41A472A286C5C5EB18EF65D1583BDA363EB01FC8FD48431D64C1A69AEF6CD4C48361

Function 00007FF76D6B4258 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D6B3E38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6B3E79
Part of subcall function 00007FF76D6B3E38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6B3EF9
Part of subcall function 00007FF76D6B3E38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6B3F4D
Part of subcall function 00007FF76D6B3E38: _get_daylight.LIBCMT ref: 00007FF76D6B3FA5

CreateFileW.KERNEL32 ref: 00007FF76D6B435E
CreateFileW.KERNEL32 ref: 00007FF76D6B43AE
GetLastError.KERNEL32 ref: 00007FF76D6B43DE
GetFileType.KERNEL32 ref: 00007FF76D6B43F3
GetLastError.KERNEL32 ref: 00007FF76D6B43FD
CloseHandle.KERNEL32 ref: 00007FF76D6B4430
CloseHandle.KERNEL32 ref: 00007FF76D6B4594
CreateFileW.KERNEL32 ref: 00007FF76D6B45C9
GetLastError.KERNEL32 ref: 00007FF76D6B45D8

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: c371a098d1ed890db9e0e1017008efad7e651166628c24d51931c4570b1b57a6
Instruction ID: bf61be4bd4029caafc214e63de0d64b9dc16fdec7dea12da8862abadcaa3f0ce
Opcode Fuzzy Hash: c371a098d1ed890db9e0e1017008efad7e651166628c24d51931c4570b1b57a6
Instruction Fuzzy Hash: 30C1C232F28A42C5EB10EFA9C4906AC7762FB49BD8B415235DA1E57794EF38E461C720

Function 00007FF76D622BB0 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D622C13

Strings

content, xrefs: 00007FF76D6238D1, 00007FF76D62470F, 00007FF76D6254D1, 00007FF76D625BEC, 00007FF76D626134
status, xrefs: 00007FF76D624A8E, 00007FF76D62640E, 00007FF76D62641E
filename, xrefs: 00007FF76D62371C, 00007FF76D624551, 00007FF76D6253B1, 00007FF76D625A12, 00007FF76D625F61
exists, xrefs: 00007FF76D623C2A, 00007FF76D624A59, 00007FF76D6263CD, 00007FF76D6263E8, 00007FF76D626485
directory_iterator::directory_iterator, xrefs: 00007FF76D623C4C, 00007FF76D624A78, 00007FF76D62644C

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 3668304517-3429737954
Opcode ID: 38c4d0cce02b34758d65185788091ff6bbb0dec24bda6f9e6456dfe30f3163b0
Instruction ID: df5d40b7a80f24bd11d9764cffb56933b09f4ec4da6af04ba7dca254e2cdc8d1
Opcode Fuzzy Hash: 38c4d0cce02b34758d65185788091ff6bbb0dec24bda6f9e6456dfe30f3163b0
Instruction Fuzzy Hash: 7DF030A2F3868585FB28AB64D00836DA352AB18FC9F944430DA8C0A696FF6DD4D58351

Function 00007FF76D67A861 Relevance: 9.2, APIs: 6, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF76D67A879
RegEnumKeyExA.KERNEL32 ref: 00007FF76D67A8BE
RegCloseKey.ADVAPI32 ref: 00007FF76D67AAB4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67AAE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67AAF3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67AAF9

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseEnumOpen
String ID:
API String ID: 2177193445-0
Opcode ID: a05794525d12b9a30d821ce8a90ca9d5e16ba8f7435d7b89c5328b8e4cf372e1
Instruction ID: 558c2a8ca4613db5f77b8443eabf377514af1e123c84833c806e0833f0d679a4
Opcode Fuzzy Hash: a05794525d12b9a30d821ce8a90ca9d5e16ba8f7435d7b89c5328b8e4cf372e1
Instruction Fuzzy Hash: C0717072E2CB8585EB109B64E4447ADA762FB453E8F904235EAAD03AD5EF7CE0C0C710

Function 00007FF76D6541A0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D654516
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D65451C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D654522
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D654528

Strings

exists, xrefs: 00007FF76D6544F4, 00007FF76D654509

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: exists
API String ID: 3668304517-2996790960
Opcode ID: 53aca73c336c9b658f26f7cf69bbf6a261e67c0e16274f19d30e58f184160f29
Instruction ID: 22d40b74128bf6646cce49af9f614858a9ebe5eb04c2b6ca25f700505ae943cf
Opcode Fuzzy Hash: 53aca73c336c9b658f26f7cf69bbf6a261e67c0e16274f19d30e58f184160f29
Instruction Fuzzy Hash: 64A1A772E28B46C5EB10DF64E8402AD7362FB487D8F905235EA5D07AA9EF7CE191C310

Function 00007FF76D67DB80 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF76D67DBA0
FreeEnvironmentStringsW.KERNEL32 ref: 00007FF76D67DC9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67DCC5
RtlInitUnicodeString.NTDLL ref: 00007FF76D67DD0E
RtlInitUnicodeString.NTDLL ref: 00007FF76D67DD1B

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1868271193-0
Opcode ID: 793d1491775f71d3672786ed8f4fe9ca6eed7059fa49f464038b53ec1853dd54
Instruction ID: 8d59aaebc218ac80f086ed0183327ac09838c934f55ce8ca9c5381a1fc1b2554
Opcode Fuzzy Hash: 793d1491775f71d3672786ed8f4fe9ca6eed7059fa49f464038b53ec1853dd54
Instruction Fuzzy Hash: 25518A62E2CB85C2EA109F15E440369B362FB88BD4F949231EB9D03B95EF7CE1D08714

Function 00007FF76D67A7F0 Relevance: 7.6, APIs: 5, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF76D67A879
RegEnumKeyExA.KERNEL32 ref: 00007FF76D67A8BE

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: 040e917cd92afba456472a363a755aca85739ca197cddf1a1abe7dc66a18d0d3
Instruction ID: e7ebfa0d5414fe770fe7a8e3a417e4e31a07f186f81ad23c5f0d0ebaff4c2155
Opcode Fuzzy Hash: 040e917cd92afba456472a363a755aca85739ca197cddf1a1abe7dc66a18d0d3
Instruction Fuzzy Hash: 6E318132E28B85C5E7209BA1E844AAEB365FB447D8F900235EE9D17A54EF7CD095C700

Function 00007FF76D673C90 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 413COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D6A53D0: EnterCriticalSection.KERNEL32(?,?,0000000100000000,00007FF76D621944), ref: 00007FF76D6A53E0

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67445A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D674460

Strings

ios_base::badbit set, xrefs: 00007FF76D67447B, 00007FF76D6744B8, 00007FF76D6744F6
exists, xrefs: 00007FF76D67452F

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CriticalEnterSection
String ID: exists$ios_base::badbit set
API String ID: 555700303-2074760687
Opcode ID: 156d8fc8e3239c3ba34aac912e0a6b7e8b418469f6ac63b91b7a225825b6313c
Instruction ID: f99919867a3409761c0cfef37a6cc5a901533fb2a7665ada64841c3dab14ddf1
Opcode Fuzzy Hash: 156d8fc8e3239c3ba34aac912e0a6b7e8b418469f6ac63b91b7a225825b6313c
Instruction Fuzzy Hash: 20224532D2DAC6D1DA21EB15E4943EAA362FB847D0F944231DA9D43AA9FF7CD144CB10

Function 00007FF76D627B00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D67AB00: GetLogicalDriveStringsW.KERNEL32 ref: 00007FF76D67AB71

Part of subcall function 00007FF76D627B00: FindFirstFileW.KERNEL32 ref: 00007FF76D626ECF

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D627C68
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D627C6E

Strings

content, xrefs: 00007FF76D62759F
filename, xrefs: 00007FF76D6274AA

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$DriveFileFindFirstLogicalStrings
String ID: content$filename
API String ID: 3820383557-474635906
Opcode ID: 7eb452ec9a494ae9f8cf64919d389b38330d63c44f44d2914f15c9dd8d6365eb
Instruction ID: 4251841b618a3e4dd46ac563e049cc03a9644403931803f6acc79cd2cc0bf13e
Opcode Fuzzy Hash: 7eb452ec9a494ae9f8cf64919d389b38330d63c44f44d2914f15c9dd8d6365eb
Instruction Fuzzy Hash: 82417962E2C646C1EA20AF25F44056EE362EBD47F4F985331E69D07BE9FE7CD5808610

Function 00007FF76D679E20 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNEL32 ref: 00007FF76D679E87

Strings

ProductName, xrefs: 00007FF76D679E72
--type, xrefs: 00007FF76D679E25
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF76D679E79

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Value
String ID: --type$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-3762788641
Opcode ID: 1f53e9f22b8ee8aa6c5cf43c21f35ff434b2e8a0e3a3b8a612928dfcfa761872
Instruction ID: c55a7fa73d1ea826b7d95bd0ad49cf8ef92898a19e78ee0420ebde39817e233b
Opcode Fuzzy Hash: 1f53e9f22b8ee8aa6c5cf43c21f35ff434b2e8a0e3a3b8a612928dfcfa761872
Instruction Fuzzy Hash: BA114A32A1CB85C2D7209B21F4403AAB3A5FB89788F900235EA9C06B59EFBCD154CB40

Function 00007FF76D672AC0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF76D672AFB
OpenProcessToken.ADVAPI32 ref: 00007FF76D672B0C
GetTokenInformation.KERNELBASE ref: 00007FF76D672B44
CloseHandle.KERNEL32 ref: 00007FF76D672B65

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: b58325ce29b780eef651909379bfc8c714b7e3d5217266914ac01701143baf7a
Instruction ID: 5b9dab42d15a483bdc17a8efa431b45b6a320213bf89621e6ee6690aa78aeb93
Opcode Fuzzy Hash: b58325ce29b780eef651909379bfc8c714b7e3d5217266914ac01701143baf7a
Instruction Fuzzy Hash: 7811FC32A2CB82C6E7509F11F84075AB3A1FB88B84F845135EA8D47B68EF7CE455CB50

Function 00007FF76D637540 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D637699
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D63769F

Strings

cannot use operator[] with a numeric argument with , xrefs: 00007FF76D637A69

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: cannot use operator[] with a numeric argument with
API String ID: 73155330-485864652
Opcode ID: 67eda7f26889bc733ddfeff5fe4890f10ca60ac539fe7f83e408ccdd1cd7b394
Instruction ID: 3d4adc17938a774b58f36f1c0c80067cc336d7824fc4e1cdc9bbbdd268430bf3
Opcode Fuzzy Hash: 67eda7f26889bc733ddfeff5fe4890f10ca60ac539fe7f83e408ccdd1cd7b394
Instruction Fuzzy Hash: 9A31B671F1D782C4EE14EB1AE5042A8E257AB45BE4F991730DE6D0BBD5EEBCE0518310

Function 00007FF76D67A380 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 00007FF76D67A3BA

Strings

--type, xrefs: 00007FF76D67A38B
Unknown, xrefs: 00007FF76D67A475

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: CurrentProfile
String ID: --type$Unknown
API String ID: 2104809126-2669863112
Opcode ID: 50e4149a4f36fe9e45017b92ad617ba725f782cca4f6cb9131f1630fd3cab9eb
Instruction ID: 77062f9ff2ee432917dd19942715bda1d2a057ab55d2e5118a3aaf8267857bc3
Opcode Fuzzy Hash: 50e4149a4f36fe9e45017b92ad617ba725f782cca4f6cb9131f1630fd3cab9eb
Instruction Fuzzy Hash: E231B222A2CBC5C2E620DF15F4406AAF761FB99784F941235EBCD02A4AEF7DD184CB10

Function 00007FF76D670800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF76D670851
RegCloseKey.ADVAPI32 ref: 00007FF76D670863

Strings

--type, xrefs: 00007FF76D670807

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: CloseOpen
String ID: --type
API String ID: 47109696-2654721227
Opcode ID: 2699ab7f269dbce92234196c397df38ce889de949ca90d1c3d969e5c8547cd87
Instruction ID: 314bc5300bd993e05c2d8fc6cdc56e09d7b21d30d7d63c00faee475ff9ba92d0
Opcode Fuzzy Hash: 2699ab7f269dbce92234196c397df38ce889de949ca90d1c3d969e5c8547cd87
Instruction Fuzzy Hash: D4218521F3CA45C5EF50AB22E8402AAE362EF98BD4F985131EA4D43B95EE6DD081C750

Function 00007FF76D62FA60 Relevance: 4.8, APIs: 3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: f6bb018091e4ad3e0167fd5f73ff4f1a969460449a085c0ba2f9688596738a1e
Instruction ID: fa688abcb6e14b2d3fac1c4755a076c78e594764dc2f4973071faf7b93b4289e
Opcode Fuzzy Hash: f6bb018091e4ad3e0167fd5f73ff4f1a969460449a085c0ba2f9688596738a1e
Instruction Fuzzy Hash: 80C19232A28B85C5EB20DB25E4403EDB762FB887D4F905235EA9D57B99EF78C180C710

Function 00007FF76D67859E Relevance: 4.7, APIs: 3, Instructions: 186networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF76D678909
closesocket.WS2_32 ref: 00007FF76D67891B
WSACleanup.WS2_32 ref: 00007FF76D678921
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D678A43

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Cleanupclosesocketrecv
String ID:
API String ID: 1729841683-0
Opcode ID: 3b3df0f135933830fb0054218f7aef5ff891a4c65a9293cd01eedeff48581b97
Instruction ID: 8193fa2ed54acdee8d08447aae53c5947e03a4290ba54176ebbbc3bbe284bca9
Opcode Fuzzy Hash: 3b3df0f135933830fb0054218f7aef5ff891a4c65a9293cd01eedeff48581b97
Instruction Fuzzy Hash: 02914672E2CBC5C1EA21DB19E4443ADA722FB997E0F905331D6AC56AE5EF6CD4808710

Function 00007FF76D671DD0 Relevance: 4.6, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 00007FF76D671E29
CoTaskMemFree.OLE32 ref: 00007FF76D671EEA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D671F12

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: FolderFreeKnownPathTask_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2444108017-0
Opcode ID: 172967b71784c052f5cd2d2a4d5613b6e69080b217eb3b5ea33015cbd0a5ac62
Instruction ID: 9f8f0646c26c8ae2f64f827c00c6fb956c4c109b92946f56e709af4cd1a8d98d
Opcode Fuzzy Hash: 172967b71784c052f5cd2d2a4d5613b6e69080b217eb3b5ea33015cbd0a5ac62
Instruction Fuzzy Hash: 10316472D2CB8581E720DF65E44026AA761FB987E4F545336EAAC03AA5EF7CD1818B40

Function 00007FF76D687764 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D68778B

Part of subcall function 00007FF76D687720: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D687737

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D687838
_local_unwind.LIBVCRUNTIME ref: 00007FF76D687849

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_local_unwind
String ID:
API String ID: 1677304287-0
Opcode ID: bf7ff17dcb7492c4667a4e3f85a5f987f8021e196c42520ea16941355517f9df
Instruction ID: 342961139806f1ef20101a620380978873f289494efc2b24932fe07f56a62251
Opcode Fuzzy Hash: bf7ff17dcb7492c4667a4e3f85a5f987f8021e196c42520ea16941355517f9df
Instruction Fuzzy Hash: 03216972E3CA46C1EA50FB14E8501B9A363AB95BD4FC81132E61E462A2EE7DE504C730

Function 00007FF76D67A52B Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF76D67A547
RegQueryValueExA.KERNEL32 ref: 00007FF76D67A586
RegCloseKey.ADVAPI32 ref: 00007FF76D67A624

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f077da70b4df0df4445bd9fb1d487173819d964e831059c3839018c83ece85ec
Instruction ID: d4d6c603864a4c2dc946243203d543d3ba346b5201963e6f341b069e6088b560
Opcode Fuzzy Hash: f077da70b4df0df4445bd9fb1d487173819d964e831059c3839018c83ece85ec
Instruction Fuzzy Hash: 6221A762E2C785C1EA10DB25E45177EE762FFD57D4F805231EA9D42A99FE2CD0848B10

Function 00007FF76D679080 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 00007FF76D6790A5
GetGeoInfoA.KERNEL32 ref: 00007FF76D6790BD
GetGeoInfoA.KERNEL32 ref: 00007FF76D67910D

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 13d6c8570dd485256c110f571c40c9a01fa7513018fe1e8d2ffc8141344c43e0
Instruction ID: c4347a1d863391255c76d9ff3737b156125738ad5f59911c41016a61d26f6cca
Opcode Fuzzy Hash: 13d6c8570dd485256c110f571c40c9a01fa7513018fe1e8d2ffc8141344c43e0
Instruction Fuzzy Hash: 0211BE32A28B85C7D7109F21E45475AB3A2FB90BC8F445135EB8903B59EF7CE5508B84

Function 00007FF76D68FB24 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF76D68FB20), ref: 00007FF76D68FB35
TerminateProcess.KERNEL32(?,?,?,00007FF76D68FB20), ref: 00007FF76D68FB40
ExitProcess.KERNEL32 ref: 00007FF76D68FB4F

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 00e5c381b48270d40a54af0ff3367ad9dc702e6598c8cac93f1b96722a3b8739
Instruction ID: be0d49efc6344cc24ab8955458b7d31dd0adcfeecfb48c77c0dc3f519e5c9897
Opcode Fuzzy Hash: 00e5c381b48270d40a54af0ff3367ad9dc702e6598c8cac93f1b96722a3b8739
Instruction Fuzzy Hash: 8ED06C10F3C603C6EA283B7098A507893935F987D1F901438C90A077A2EE3CE84A8630

Function 00007FF76D6810D0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6812D5

Strings

ios_base::badbit set, xrefs: 00007FF76D6810D2

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ios_base::badbit set
API String ID: 3668304517-3882152299
Opcode ID: 52db09497a5d91ac7e02eea905f8d1ed387ec103d0ff1c56d0a58c43504bcc7e
Instruction ID: eb310f3d483eb895c46032f5c19e57a035d2a2bcc260e9bb480ffed34f221a38
Opcode Fuzzy Hash: 52db09497a5d91ac7e02eea905f8d1ed387ec103d0ff1c56d0a58c43504bcc7e
Instruction Fuzzy Hash: B961D322F1CA81CAFB119BB8D4003FCB372AF55788F445230DF9D22A95EF38A5958364

Function 00007FF76D67FC70 Relevance: 3.3, APIs: 2, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a37f049a9f8dbf12e284a61f8f3ec1f4250e8bf9391b6cd93a1fbb91f70d8dd
Instruction ID: 46c979576157c06e9e7654f68a7f99289faf952e479da362b9e77497ba3d33b1
Opcode Fuzzy Hash: 2a37f049a9f8dbf12e284a61f8f3ec1f4250e8bf9391b6cd93a1fbb91f70d8dd
Instruction Fuzzy Hash: 19A19172E18B8586EB10DF25D8443ADB7A1FB85B98F588235EA4D47799EF3CC481C710

Function 00007FF76D63B840 Relevance: 3.2, APIs: 2, Instructions: 206COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D63B9B5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D63B9C1

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 8a1450b686805fa37bca6adc8c0aebeb1de2dbd846e7303aa09ce8a3a431e301
Instruction ID: 25fca854b137c981896c79d64b78b7add5395d263a486e09ba95d2ba6b60fd2b
Opcode Fuzzy Hash: 8a1450b686805fa37bca6adc8c0aebeb1de2dbd846e7303aa09ce8a3a431e301
Instruction Fuzzy Hash: EC61CF22F2CB8581E910EB1AE80027AA351FB45BE4F958635DEAD077D4EF7CE051C310

Function 00007FF76D686720 Relevance: 3.2, APIs: 2, Instructions: 183COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D68695B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D686967

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 90c6a1321480a5bb2a134b98c1104961fed274e6a5262b1de9d70769bd84d02e
Instruction ID: db2f432be314e4bba8bfcb5b72b233bfb71364d06102280a521937874cfc1684
Opcode Fuzzy Hash: 90c6a1321480a5bb2a134b98c1104961fed274e6a5262b1de9d70769bd84d02e
Instruction Fuzzy Hash: 2F618F72E2D646C4EE24EE96904427DA762EB15BD4F944631CFAD0B7D1EE3CE48183B0

Function 00007FF76D670550 Relevance: 3.2, APIs: 2, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D670800: RegOpenKeyExA.KERNEL32 ref: 00007FF76D670851
Part of subcall function 00007FF76D670800: RegCloseKey.ADVAPI32 ref: 00007FF76D670863

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6707E9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6707EF

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseOpen
String ID:
API String ID: 3087652857-0
Opcode ID: 99108861c545486321ea3f073711e629e90b01f7b5e2f93642e8af6af0c3cdbc
Instruction ID: 29d3258af3a18608887d3ce01ea614df7606e5d67d6cd82a777b714c2f5d83ec
Opcode Fuzzy Hash: 99108861c545486321ea3f073711e629e90b01f7b5e2f93642e8af6af0c3cdbc
Instruction Fuzzy Hash: 3971AE32A2CB85C4EB10DB65E4403ADB762F7887D4F945232EA9C47B99EF78D184C710

Function 00007FF76D631020 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D63120F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D631215

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: d3b2b29c12d76606109adc5272ae60bb3f9a894a02f4870b54990e5e516f1c04
Instruction ID: 383ab9673273034b61d07461d2fe5ff4c02f003b98a8783d668fadb069df4025
Opcode Fuzzy Hash: d3b2b29c12d76606109adc5272ae60bb3f9a894a02f4870b54990e5e516f1c04
Instruction Fuzzy Hash: 53518A32A18B42C5EB15AF29D4542ACA3A2FB49FE4F955231CE2D47398EF7CD481C310

Function 00007FF76D684220 Relevance: 3.2, APIs: 2, Instructions: 153COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D684403
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D68440F

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 917f2990652e247f87a23d6c1984d931d10ac0dabe79eb90012f6a05e0376f17
Instruction ID: e69de4f009a6a67a78f14d14a5f70190b4723980c8c741423d093efc4a8259d9
Opcode Fuzzy Hash: 917f2990652e247f87a23d6c1984d931d10ac0dabe79eb90012f6a05e0376f17
Instruction Fuzzy Hash: F651E672B28B45C2E610EF56E440269A7A6FB58BE4F944635DFAC437C4EF78E090C310

Function 00007FF76D679BA0 Relevance: 3.2, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D672CC0: __std_fs_get_current_path.LIBCPMT ref: 00007FF76D672D38

GetVolumeInformationW.KERNEL32 ref: 00007FF76D679C2D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D679E0E

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: InformationVolume__std_fs_get_current_path_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3375085511-0
Opcode ID: 829792834a69022ed63cbf821d847143a14b4c8bbfa548f85f648e8f154bbd2f
Instruction ID: 95ce74beb77ac55c204c989cbdabb3761d9f3e0ea609550c5a93bf34b3d5d8d4
Opcode Fuzzy Hash: 829792834a69022ed63cbf821d847143a14b4c8bbfa548f85f648e8f154bbd2f
Instruction Fuzzy Hash: F1714C32E28B85C9E710DF64E8802ED77B5F788798F904236EA8D53A59EF78D184C750

Function 00007FF76D65BC80 Relevance: 3.1, APIs: 2, Instructions: 125COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D65BE19
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D65BE25

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: e961f39f10dea6b1b951e3f702a5665c75e0fb64c003f873190661657069de4f
Instruction ID: a7d5ac9c2b73be622e497dfea43b50326ba3499ecf58f6fab279fd71f8ed0e23
Opcode Fuzzy Hash: e961f39f10dea6b1b951e3f702a5665c75e0fb64c003f873190661657069de4f
Instruction Fuzzy Hash: D5417372A1CA85C1D924EF55E4442BDE7A2FB48BD0FA44635DBAD03B95EF3CD0958210

Function 00007FF76D6376B0 Relevance: 3.1, APIs: 2, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D637848
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D63784E

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 358258d3dcc3a5e45d7442ed84536c277b9443a3dc230a617b72cf71502c3497
Instruction ID: c3724a5d0dc9e576c5f9ad36892f7d4cf211e7d85397b7e2a7e98be9d62dcd20
Opcode Fuzzy Hash: 358258d3dcc3a5e45d7442ed84536c277b9443a3dc230a617b72cf71502c3497
Instruction Fuzzy Hash: D441B221F2C685C1EA20EB15E5042AAE766FB45BD4F985631DFAD07BC9EEBCE041C310

Function 00007FF76D61FC40 Relevance: 3.1, APIs: 2, Instructions: 123COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 00007FF76D61FD53

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: ee834aff421969feab66dfcbe23238124499f408b33a583414f1b0ff1dd4b975
Instruction ID: e0c28379a6121fcc26c155371276a82c23dcd65fb9dfc8ad7260fbc83be8a0de
Opcode Fuzzy Hash: ee834aff421969feab66dfcbe23238124499f408b33a583414f1b0ff1dd4b975
Instruction Fuzzy Hash: ED41E363E2C64281EA21AB19E8402B9A362EB857F4F844335EE6D437D5FF3CE0858710

Function 00007FF76D63B9D0 Relevance: 3.1, APIs: 2, Instructions: 111COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D63BB3C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D63BB48

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: a6bac2aa78eae61604f67457e4f2594b90f5bfa48044f55b22bd3801929c0bb4
Instruction ID: 086f84ce88c00ef2b2ed26ae8d97719f2e7b8f18b237ebbc37069080623ad1fd
Opcode Fuzzy Hash: a6bac2aa78eae61604f67457e4f2594b90f5bfa48044f55b22bd3801929c0bb4
Instruction Fuzzy Hash: 4531E322F2CB85C1E924EB5AE8001BAE351FB45BE4F954A35DEAD07BD5EE7CE0418310

Function 00007FF76D636D59 Relevance: 3.1, APIs: 2, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca5caea0c0b3309ab7f85286d9bd6a9805a08802168af73e164575559199924
Instruction ID: 2c91373b3064b73298689381adb7e842186a887b81dba7f92e88f80373346f53
Opcode Fuzzy Hash: bca5caea0c0b3309ab7f85286d9bd6a9805a08802168af73e164575559199924
Instruction Fuzzy Hash: 4D31D522F2D641C1EE24EB55E5001B8E393EB48BD4F891631DAAD0BBC5EE6CE0958350

Function 00007FF76D64B750 Relevance: 3.1, APIs: 2, Instructions: 101COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64B8CB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64B8D1

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: bafe73965b2e3d64d017613704750c268096e2ead7eb7d6d81b8e256c907890b
Instruction ID: e74f30a4393de52c7981e728cbfb95a37524babd91af98db4ab702026b4f46c5
Opcode Fuzzy Hash: bafe73965b2e3d64d017613704750c268096e2ead7eb7d6d81b8e256c907890b
Instruction Fuzzy Hash: A841D772E2C685C5EA20EB28E04536EA752FB857E4F904335E6AC467D5EF2CD084CB10

Function 00007FF76D631A80 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D631B80
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D631B8C

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 333327eab2b5fef04e94eda38af90cb6394d0d07ba610ef94ea7a8ecf7457eca
Instruction ID: 09f45af00b02ba1aafcf215f9f38b09902579eb58e26919c3d8fc681fc5e73b5
Opcode Fuzzy Hash: 333327eab2b5fef04e94eda38af90cb6394d0d07ba610ef94ea7a8ecf7457eca
Instruction Fuzzy Hash: 6A21F422E19B8281EE19EB15E5002B9A252EF44BF4F644731DA7D03BD6FEBCD4D28350

Function 00007FF76D626C10 Relevance: 3.1, APIs: 2, Instructions: 94COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D626D28
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D626D2E

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 73d5e996c6fa946fc4cbfc32bb763f059e6395303f35a3db09b10d0f9e2bc16c
Instruction ID: 5113dd24789868e0e9a3774bc507025dcfda6605b447c3e1981c4b3f53b60847
Opcode Fuzzy Hash: 73d5e996c6fa946fc4cbfc32bb763f059e6395303f35a3db09b10d0f9e2bc16c
Instruction Fuzzy Hash: 5931CF62F19646C1EA19FB55E000278A292EB44BF4FA48731CA7D06BD5FF7CE4D28390

Function 00007FF76D668142 Relevance: 3.1, APIs: 2, Instructions: 61synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D62E5A0: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF76D62E5E8
Part of subcall function 00007FF76D62E5A0: Process32FirstW.KERNEL32 ref: 00007FF76D62E62A

Part of subcall function 00007FF76D62C9C0: CredEnumerateA.ADVAPI32 ref: 00007FF76D62CA22

Part of subcall function 00007FF76D678210: recv.WS2_32 ref: 00007FF76D6783EE

ReleaseMutex.KERNEL32 ref: 00007FF76D6681A8
CloseHandle.KERNEL32 ref: 00007FF76D6681B1

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 2d37dbbcdc278812d2fb94bd079e8b6fd7dbb725c2e877b23f4f2f28be93ce96
Instruction ID: 7e0e776c1e46fd034ee87f75e32f1c057414389403ac1ab656ade0a3d5e151f0
Opcode Fuzzy Hash: 2d37dbbcdc278812d2fb94bd079e8b6fd7dbb725c2e877b23f4f2f28be93ce96
Instruction Fuzzy Hash: 0A212C61E3CAC2C0FA21BBB594062FDD323AF897D0FC41531E95D52AD7BE2CA4408272

Function 00007FF76D696A78 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF76D696A18,?,?,?,?,?,?,?,00007FF76D696B6D), ref: 00007FF76D696AC4
GetLastError.KERNEL32(?,?,?,?,?,00007FF76D696A18,?,?,?,?,?,?,?,00007FF76D696B6D), ref: 00007FF76D696ACE

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 558e61541b40b1db2d94306fe445127bdb7d9f4201fb97becbd1ea20618c89ce
Instruction ID: 53aebc7ca6f6d23e5915a5c40320ba6f6d1e14abf0f16d953b13625b2a46ae4c
Opcode Fuzzy Hash: 558e61541b40b1db2d94306fe445127bdb7d9f4201fb97becbd1ea20618c89ce
Instruction Fuzzy Hash: 3E119461A2CB82C5DA10AB26A504169E763AB44BF4F944331EE7E0B7E9EF7CD4508790

Function 00007FF76D6A54E0 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D6A5510

Part of subcall function 00007FF76D6A62FC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF76D6A6305

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D6A5516

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 9b26ece190ddfef467b4df6d1441cacb056fd69bbf8aa7748d5518b3e61eb427
Instruction ID: 8ee021869959a4489f8fdbe134ff09dd13a58d379c037e080769622b91ff1dd6
Opcode Fuzzy Hash: 9b26ece190ddfef467b4df6d1441cacb056fd69bbf8aa7748d5518b3e61eb427
Instruction Fuzzy Hash: 2AE0EC60E3D107C5FD29B26A14150B582434F597F1EAC1B30DABD08AC3BD1CE4554570

Function 00007FF76D694454 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF76D69E5C2,?,?,?,00007FF76D69E93F,?,?,00000000,00007FF76D69C67C,?,?,?,00007FF76D69C5AF), ref: 00007FF76D69446A
GetLastError.KERNEL32(?,?,?,00007FF76D69E5C2,?,?,?,00007FF76D69E93F,?,?,00000000,00007FF76D69C67C,?,?,?,00007FF76D69C5AF), ref: 00007FF76D694474

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2ec01da6e00d8dba875950f448c3bd01e8b433f0394c9c223fce95592ce8bd56
Instruction ID: 5a8e291595fdf4d1f9a8bdd374c6a8c7b2c24b96918cdb711b9a52eede29170d
Opcode Fuzzy Hash: 2ec01da6e00d8dba875950f448c3bd01e8b433f0394c9c223fce95592ce8bd56
Instruction Fuzzy Hash: 1DE04650E2D603C2FA187BB29848178A2939F88BC0B844434CA1D462A1FE6CA8454A74

Function 00007FF76D632E3D Relevance: 1.8, APIs: 1, Instructions: 256COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D63326D

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 92546de198db13050bf6a0ee85f933f0242c43d558a007e956b641f9dacdc5fc
Instruction ID: fdb7e3a4ea419ceb2bb249fbc5f19503320c90e756ef15b7bd9aba16562476a4
Opcode Fuzzy Hash: 92546de198db13050bf6a0ee85f933f0242c43d558a007e956b641f9dacdc5fc
Instruction Fuzzy Hash: B0B17C32F28A41C4EB10EB65D5442ADB772FB04BD8F866136CF5D17A99EFB8D4908360

Function 00007FF76D642FD0 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6432D7

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e4b8d00b2f4a2b2c3fe659e53da02b0277adb178f8ddf6ec7fb22caa92f537c5
Instruction ID: 13aa917ed2bbd6cacd4a704896ed35805321b5233c6def2f4d29ad304e1cc514
Opcode Fuzzy Hash: e4b8d00b2f4a2b2c3fe659e53da02b0277adb178f8ddf6ec7fb22caa92f537c5
Instruction Fuzzy Hash: 9AB18232B18A41C9DB20DF35D0942ADB3A2FB48B98F845632EB5D43B99EF39D559C310

Function 00007FF76D622C20 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D622F24

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: f68d042aa357bee486a677adf6ce174f7eaaafe39d83ea2a1ca2d5128a296e77
Instruction ID: 39d0e7ff2bf96f1f9c48683ba31bd33c9bc6dadadd7b75a5b1c3e956c9aeed9e
Opcode Fuzzy Hash: f68d042aa357bee486a677adf6ce174f7eaaafe39d83ea2a1ca2d5128a296e77
Instruction Fuzzy Hash: 17919F22E2CBC585E721DB68E4403ADA7A1FB99398F545335EACC12A99FF6CD184C710

Function 00007FF76D694950 Relevance: 1.6, APIs: 1, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D694978

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 985c8f8dae62dc047e201b1b9ca2207f088a02bc60b06dc54add248a105844ea
Instruction ID: 38059ad1303f6706c1c881f1b4c91a2b55a512093c5e24e80c56d5092ad8300b
Opcode Fuzzy Hash: 985c8f8dae62dc047e201b1b9ca2207f088a02bc60b06dc54add248a105844ea
Instruction Fuzzy Hash: B441B632D2C202C7EA34AA199540279B3A3EF547D4F940171D69E4B799EF7DF802C764

Function 00007FF76D6798D0 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D679A57

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 0152e75ec3e23d29e7f8a3f0aa9e2e3c45109ca1da6a47a27d089a26da3d125d
Instruction ID: 4513a6421de341e24ef8836729034be26702236650079691fe7019fb2d323b06
Opcode Fuzzy Hash: 0152e75ec3e23d29e7f8a3f0aa9e2e3c45109ca1da6a47a27d089a26da3d125d
Instruction Fuzzy Hash: 01413832F25B488DEB009BB9E4413AC73B6E74879CF404625EE9C66B99EE3481648394

Function 00007FF76D647F50 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D648075

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 65d0d06f96b867ddb43fd1b4f97a314bbc05da4afbd5cdcd58a656198bf73c93
Instruction ID: 30fc06eca42ee6cd44824f683c744cabc5802e37ac470c6861545181bbd8a28b
Opcode Fuzzy Hash: 65d0d06f96b867ddb43fd1b4f97a314bbc05da4afbd5cdcd58a656198bf73c93
Instruction Fuzzy Hash: AA414973A18B41C6DB14DF16E480169B7B1FB98F98B558635EB8D43364EF38D8A0C3A0

Function 00007FF76D6963E8 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6964DF

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8a09153dc28454014ad16fa4410b2a8e400d7f5b281336c33c9fc96a651bd4e
Instruction ID: 134843a1d0b237a63cbcc82b2ebcfb3c9d04c4ca21b440391e269ba8006273bf
Opcode Fuzzy Hash: f8a09153dc28454014ad16fa4410b2a8e400d7f5b281336c33c9fc96a651bd4e
Instruction Fuzzy Hash: 13319022E2C603C9F6117B91884137CA653AF81BE5FC54176E91D073D2EF7CA84486B0

Function 00007FF76D632B20 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D632BBD

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: bee351596a2aef4efa20bf9dd88d37045f3761a70983d77169941ca1d4ddd2e9
Instruction ID: 23946e0438ddb083769b05411220415c7e8b67f658fd5206d18d9c78dbaf9621
Opcode Fuzzy Hash: bee351596a2aef4efa20bf9dd88d37045f3761a70983d77169941ca1d4ddd2e9
Instruction Fuzzy Hash: 61110476A19B49C6DB159F6DD09426C7362EB8CFD9B919032CE4D47368DF38C890C390

Function 00007FF76D68FA55 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF76D68FA83

Part of subcall function 00007FF76D68FB88: GetModuleHandleExW.KERNEL32 ref: 00007FF76D68FBAD
Part of subcall function 00007FF76D68FB88: GetProcAddress.KERNEL32 ref: 00007FF76D68FBC3
Part of subcall function 00007FF76D68FB88: FreeLibrary.KERNEL32 ref: 00007FF76D68FBEA

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 0811f9d8943a53f8311caa714f7c9a3ffa867de5962449656e8e36dab8aaf5e5
Instruction ID: e3ee7511569efa83d8842d203e5141f4301936fe4e37e00537901b5481a88f29
Opcode Fuzzy Hash: 0811f9d8943a53f8311caa714f7c9a3ffa867de5962449656e8e36dab8aaf5e5
Instruction Fuzzy Hash: 8F219531E28B06C9EB24AF64C4402FC77A1EB447A8F944636D71D07AD5EF39D585C760

Function 00007FF76D6AEFC8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6AEF25

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 071eab0d2ddb6d97d7b7232e2de0088f1d155ba52ad6f2216ba9fc5c62e5c193
Instruction ID: cbfc56b41368163eb35095ed8c6ca5fea8679cf0038b6767fcf1525a40f2d439
Opcode Fuzzy Hash: 071eab0d2ddb6d97d7b7232e2de0088f1d155ba52ad6f2216ba9fc5c62e5c193
Instruction Fuzzy Hash: 16113321F2C686C1EB60BF519410179E3A6EF95BC0F984432EA8C87A97EF7CE9414774

Function 00007FF76D6B3AFC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6B3B1F

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d449f7bd6633de8b8bd08ff16019e33518f74ffb8b7583db2479c3fafe75e578
Instruction ID: 4fd194f3fe35e7814e8709cb3a1acbd071ecc8d61d3bb38a92572951e8930507
Opcode Fuzzy Hash: d449f7bd6633de8b8bd08ff16019e33518f74ffb8b7583db2479c3fafe75e578
Instruction Fuzzy Hash: 9C21C532F2CA42C7D761AF18E440379B6A2EB94BD4F944234D65D476D9EF3CD4108B10

Function 00007FF76D674540 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF76D674588

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 96e4cb0db8931e5393824d0ecfe825f058e215f5b5777a5c71bbd2f46533e8b7
Instruction ID: c311038b425cbc53258ef9949cbec9a5e07136e851075d1bf245cf02742be0b8
Opcode Fuzzy Hash: 96e4cb0db8931e5393824d0ecfe825f058e215f5b5777a5c71bbd2f46533e8b7
Instruction Fuzzy Hash: B901A221F2CA85C1EB509F16B944129A3A1FB8CFD4F885130EE5D03B58EF68E8418B40

Function 00007FF76D627671 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE ref: 00007FF76D6276B4

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 9cd3b2291a3f23570049eab3fc1e6fef5472ba74db640f5840e90f60f9558740
Instruction ID: ca1ebf89f3fc02fc7bbe57cd96ef976bccb457db159fc6eafa16225a00289115
Opcode Fuzzy Hash: 9cd3b2291a3f23570049eab3fc1e6fef5472ba74db640f5840e90f60f9558740
Instruction Fuzzy Hash: C201FF26A2CAC1C1DA70DB56F4542ABA365FB88BD4F944072DE8D43B59EE3CD846CB10

Function 00007FF76D687E64 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D687E83

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e3199247b15e626e1ff80a5878ee6ff274038b46c14856a595a092b0a0f0e46b
Instruction ID: 27db34db700be07fc04b4bcf8c43a1f45dd843166d788867a2720df10db25b06
Opcode Fuzzy Hash: e3199247b15e626e1ff80a5878ee6ff274038b46c14856a595a092b0a0f0e46b
Instruction Fuzzy Hash: E7E0ED32E2C603C1EB20BAA8A584038E2A25F147F0F908731EA7C026C6EF2898504630

Function 00007FF76D6AC048 Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?,?,?,00007FF76D61FD7B,?,?,?,?,00000000,00000000,FFFFFFFF,?,?,00007FF76D633F5F), ref: 00007FF76D6AC04C

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 90da3352575779015bf82052fd36c7aa4f0d5469104e151cce640f4290d1ac4f
Instruction ID: a8554ee776bd0d83b664236738f822924ebaf3c0b5f403b1dc6162c484af8bf2
Opcode Fuzzy Hash: 90da3352575779015bf82052fd36c7aa4f0d5469104e151cce640f4290d1ac4f
Instruction Fuzzy Hash: 2DC04C14F6D902C2E66437625C8622192A16F45780FD48431C11D84160ED1DA5A64A71

Function 00007FF76D6ADB70 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF76D67A118), ref: 00007FF76D6ADB79

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 9a96f232a94608228943c1438b0803d9c53371bfd202436300ffcab614f7d4f0
Instruction ID: a11af446190b0dac325c53e0b9255a793a575b0275c43e1730b100f1612160d1
Opcode Fuzzy Hash: 9a96f232a94608228943c1438b0803d9c53371bfd202436300ffcab614f7d4f0
Instruction Fuzzy Hash: 5AB09226E288C0C3C621FB04E842019B332FB98B09FD00021E28D82624EE2CDA2A8E00

Function 00007FF76D694ABC Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF76D6912B6,?,?,8000000000000000,00007FF76D68D1D5,?,?,?,?,00007FF76D696E44,?,?,?), ref: 00007FF76D694B11

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 9ea8c36b1c5ce044bdb4946de57d8b5d265c478620b4be733f447649d6e2b818
Instruction ID: 7aa1995048ffe2ce4a16268584531e4c67e42228dae36ab67dd53b4760301154
Opcode Fuzzy Hash: 9ea8c36b1c5ce044bdb4946de57d8b5d265c478620b4be733f447649d6e2b818
Instruction Fuzzy Hash: 5CF04994F2D617C1FE687A6258513B592839F9CBC0F8C5471C91E8A699FDACF8804638

Function 00007FF76D696DF4 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF76D6A71A3,?,?,?,?,?,?,?,?,0000000100000000,00007FF76D6ACE65), ref: 00007FF76D696E32

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c374065ae54e37142203b7ce4bf8e8709c0fa599dd5bee20d3e6af25bcd0fdcb
Instruction ID: 325c8d70cdf6b8c7c359a0cbc01aa809a3fb522b8de26b26aba337a9e2827d1c
Opcode Fuzzy Hash: c374065ae54e37142203b7ce4bf8e8709c0fa599dd5bee20d3e6af25bcd0fdcb
Instruction Fuzzy Hash: ABF0F811E3D307C5FA6477A29D556B592835F847E0FC84670D92E8A2D1FE6CE84145B0

Non-executed Functions

Function 00007FF76D6745D0 Relevance: 71.1, APIs: 35, Strings: 4, Instructions: 2875COMMON

Download Yara Rule

Strings

type must be string, but is , xrefs: 00007FF76D677C03, 00007FF76D677CBB, 00007FF76D677D91, 00007FF76D677DEB
cannot compare iterators of different containers, xrefs: 00007FF76D677C45, 00007FF76D677CFD, 00007FF76D677E3F
value, xrefs: 00007FF76D674E03
cannot use push_back() with , xrefs: 00007FF76D677B9D

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: cannot compare iterators of different containers$cannot use push_back() with $type must be string, but is $value
API String ID: 73155330-2711811579
Opcode ID: 5e122cef7900a2df7c2627a5efcc6042ec1e73dcd0b8c4c9023047299785a60e
Instruction ID: b9205ef538bc128e150d385286222c60d8539df848b50498175be9a947afe278
Opcode Fuzzy Hash: 5e122cef7900a2df7c2627a5efcc6042ec1e73dcd0b8c4c9023047299785a60e
Instruction Fuzzy Hash: 2A635332E29BC5C9EB70AF24D8403ED6362FB45798F805235D69D4BA99EF78D284C350

Function 00007FF76D689EE4 Relevance: 47.4, APIs: 24, Strings: 2, Instructions: 1877COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D68A218
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D68A477
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D68A73D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D68A984
memcpy_s.LIBCPMT ref: 00007FF76D68ABEA
memcpy_s.LIBCPMT ref: 00007FF76D68AE72
memcpy_s.LIBCPMT ref: 00007FF76D68B08B
memcpy_s.LIBCPMT ref: 00007FF76D68B106
memcpy_s.LIBCPMT ref: 00007FF76D68B13B
memcpy_s.LIBCPMT ref: 00007FF76D68B176
memcpy_s.LIBCPMT ref: 00007FF76D68B2A2
memcpy_s.LIBCPMT ref: 00007FF76D68B3C7
memcpy_s.LIBCPMT ref: 00007FF76D68B472
memcpy_s.LIBCPMT ref: 00007FF76D68B4BD
memcpy_s.LIBCPMT ref: 00007FF76D68B58A
memcpy_s.LIBCPMT ref: 00007FF76D68B713
memcpy_s.LIBCPMT ref: 00007FF76D68B78A
memcpy_s.LIBCPMT ref: 00007FF76D68B7CF
memcpy_s.LIBCPMT ref: 00007FF76D68B881
memcpy_s.LIBCPMT ref: 00007FF76D68B9AE
memcpy_s.LIBCPMT ref: 00007FF76D68AC86

Part of subcall function 00007FF76D68C304: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D68C336

memcpy_s.LIBCPMT ref: 00007FF76D68BB68

Strings

, xrefs: 00007FF76D68BA5B
, xrefs: 00007FF76D68B92E

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: 96773815cc5883af5be3912948e5dc75a65a31fd4e8c4fd35706005d9fd3310d
Instruction ID: 001a881cb6db0047fe88dfccb79290f923afeced0bc06cf10f04bfbbe6be3f73
Opcode Fuzzy Hash: 96773815cc5883af5be3912948e5dc75a65a31fd4e8c4fd35706005d9fd3310d
Instruction Fuzzy Hash: F803A672E2C1C2CBE7759E25D540BF9B792FB547CCF845135DA0A57B84EB38AA008B60

Function 00007FF76D6400ED Relevance: 36.1, APIs: 10, Strings: 10, Instructions: 1062COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6413A0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6413A6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6413AC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6413B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6413B8
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D6413E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D641450
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D641456
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D6414A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6414EE

Strings

No closed word, xrefs: 00007FF76D6413E7, 00007FF76D64140A
key declared, but no value, xrefs: 00007FF76D641337, 00007FF76D64135A, 00007FF76D64145C
key opened, but never closed, xrefs: 00007FF76D64147F
quote was opened but not closed., xrefs: 00007FF76D641314, 00007FF76D64137D
#include, xrefs: 00007FF76D64075A
word wasnt properly ended, xrefs: 00007FF76D64142D, 00007FF76D6414A8
#base, xrefs: 00007FF76D640786
", xrefs: 00007FF76D6401EC
unexpected key without object, xrefs: 00007FF76D6413BE
unexpected '}', xrefs: 00007FF76D6414CB

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: "$#base$#include$No closed word$key declared, but no value$key opened, but never closed$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 3936042273-2543107223
Opcode ID: be0f1057ab591b81fc1166b9163d378615f76450ddae4790f62b7dc74e39fc5f
Instruction ID: ea3c41a621f83fd5b3329c65b646deb1acca66101da04a97e54980b442ca0b24
Opcode Fuzzy Hash: be0f1057ab591b81fc1166b9163d378615f76450ddae4790f62b7dc74e39fc5f
Instruction Fuzzy Hash: 72A2A262E2CAC6C5EB61AF25C8443ECA762FB547C8F849131DA4D07A99EF7CD589C310

Function 00007FF76D629A59 Relevance: 34.3, APIs: 14, Strings: 5, Instructions: 1060COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D61EEB0: __std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF76D61EF2E
Part of subcall function 00007FF76D61EEB0: __std_fs_convert_wide_to_narrow.LIBCPMT ref: 00007FF76D61EF6A

Part of subcall function 00007FF76D631990: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6319E8

Part of subcall function 00007FF76D61F3F0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D61F450

Part of subcall function 00007FF76D630AC0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D630B94

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62AD96
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADAC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADB2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADB8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADBE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADC4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADCA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADD0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADD6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADDC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADE2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADE8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADEE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62ADF4

Strings

!, xrefs: 00007FF76D62A66F
content, xrefs: 00007FF76D629CF9, 00007FF76D629FDF, 00007FF76D62A87B
status, xrefs: 00007FF76D62AD9F
users, xrefs: 00007FF76D62A319
filename, xrefs: 00007FF76D629C97, 00007FF76D629F83, 00007FF76D62A7A8

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_fs_convert_wide_to_narrow
String ID: !$content$filename$status$users
API String ID: 1223724100-3795777748
Opcode ID: 68ce50245ca770b9b486228ef90141bd1ceffc7e7a53cc89049ea39f299aa246
Instruction ID: d08eb63f9649dd36419709b70fe510e48933caccd92fdf7df12e99a48837c5f4
Opcode Fuzzy Hash: 68ce50245ca770b9b486228ef90141bd1ceffc7e7a53cc89049ea39f299aa246
Instruction Fuzzy Hash: 07B29162A29BC6C9DB21EF34D8503EDA362FB45798F805231DA5D4BA99FF78D244C310

Function 00007FF76D627ED0 Relevance: 31.1, APIs: 15, Strings: 2, Instructions: 1358COMMON

Download Yara Rule

Strings

Software, xrefs: 00007FF76D628344, 00007FF76D628530
exists, xrefs: 00007FF76D6295E3

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID: Software$exists
API String ID: 0-2364128853
Opcode ID: 3f2ae3aa0db0c83e31de6e3ddd1a350099d328485ec6be8aaa97c0ada7e70598
Instruction ID: d1996ee9ca5947a41f29c692bbec608c3d7dcbf06e061614b5f83b239b4baf51
Opcode Fuzzy Hash: 3f2ae3aa0db0c83e31de6e3ddd1a350099d328485ec6be8aaa97c0ada7e70598
Instruction Fuzzy Hash: 39E27172A28BC5C9EB209F25D8443ED7361FB99798F505232DA9C17BA9EF78D580C310

Function 00007FF76D67DD50 Relevance: 29.5, APIs: 19, Instructions: 1017stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 00007FF76D67DD93
NtAllocateVirtualMemory.NTDLL ref: 00007FF76D67DDC8
lstrcpyW.KERNEL32 ref: 00007FF76D67DE2A
lstrcatW.KERNEL32 ref: 00007FF76D67DEE1
NtAllocateVirtualMemory.NTDLL ref: 00007FF76D67DF65
lstrcpyW.KERNEL32 ref: 00007FF76D67E01A
RtlInitUnicodeString.NTDLL ref: 00007FF76D67E02F
RtlInitUnicodeString.NTDLL ref: 00007FF76D67E044
LdrEnumerateLoadedModules.NTDLL ref: 00007FF76D67E057
RtlReleasePebLock.NTDLL ref: 00007FF76D67E05D

Part of subcall function 00007FF76D671DD0: SHGetKnownFolderPath.SHELL32 ref: 00007FF76D671E29
Part of subcall function 00007FF76D671DD0: CoTaskMemFree.OLE32 ref: 00007FF76D671EEA

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67E095
CoInitializeEx.OLE32 ref: 00007FF76D67E105
lstrcpyW.KERNEL32 ref: 00007FF76D67E30E
lstrcatW.KERNEL32 ref: 00007FF76D67E545
CoGetObject.OLE32 ref: 00007FF76D67E561
lstrcpyW.KERNEL32 ref: 00007FF76D67ECC1
lstrcatW.KERNEL32 ref: 00007FF76D67EF22
CoGetObject.OLE32 ref: 00007FF76D67EF3E
CoUninitialize.OLE32 ref: 00007FF76D67F4B2

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2979746431-0
Opcode ID: 250b6f680c1bc1b83b1200a70256d023a186c6c5924837420c6d7b7b0f98236c
Instruction ID: e871c9cb82df65a9dd86488ac4c99655afa1ec8b42cda9a95ba088f6dfd3607a
Opcode Fuzzy Hash: 250b6f680c1bc1b83b1200a70256d023a186c6c5924837420c6d7b7b0f98236c
Instruction Fuzzy Hash: E9D2B836629FC48AD7A18F69E88169EB3B5F788788F105225EECD57B18EF38C154C740

Function 00007FF76D62AE00 Relevance: 28.9, APIs: 10, Strings: 6, Instructions: 913COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62BE8B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62BE91
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62BE97
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62BE9D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62BEA3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62BEAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62BEB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62BEBB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62BEC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62BECD

Strings

key, xrefs: 00007FF76D62B3CA, 00007FF76D62B5A9
content, xrefs: 00007FF76D62BAF4
filename, xrefs: 00007FF76D62B97B
exists, xrefs: 00007FF76D62BE7E
directory_iterator::directory_iterator, xrefs: 00007FF76D62BE63
files, xrefs: 00007FF76D62BC5F

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: content$directory_iterator::directory_iterator$exists$filename$files$key
API String ID: 3668304517-2980817763
Opcode ID: 76b3b3eae4928eef49054ac36a9f34ecc1cacc7aeb0752cacdd59ea39a6dc98c
Instruction ID: 572c74858824ea15479f5e66ff5a4ca3ff7e6a32144215366e47793961567861
Opcode Fuzzy Hash: 76b3b3eae4928eef49054ac36a9f34ecc1cacc7aeb0752cacdd59ea39a6dc98c
Instruction Fuzzy Hash: 0EA26072A18BC5C9DB219F28D8803ED7365FB497A8F905635DA9C07B99EF78D284C310

Function 00007FF76D67D610 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 362nativelibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D6A53D0: EnterCriticalSection.KERNEL32(?,?,0000000100000000,00007FF76D621944), ref: 00007FF76D6A53E0

GetModuleHandleA.KERNEL32 ref: 00007FF76D67D68A
GetProcAddress.KERNEL32 ref: 00007FF76D67D69A

Part of subcall function 00007FF76D6A5370: EnterCriticalSection.KERNEL32 ref: 00007FF76D6A5380
Part of subcall function 00007FF76D6A5370: LeaveCriticalSection.KERNEL32 ref: 00007FF76D6A53C0

OpenProcess.KERNEL32 ref: 00007FF76D67D6DD
NtQuerySystemInformation.NTDLL ref: 00007FF76D67D704
NtQuerySystemInformation.NTDLL ref: 00007FF76D67D72F
GetCurrentProcess.KERNEL32 ref: 00007FF76D67D7FB
NtQueryObject.NTDLL ref: 00007FF76D67D848
GetFinalPathNameByHandleA.KERNEL32 ref: 00007FF76D67D942
CloseHandle.KERNEL32 ref: 00007FF76D67DA56
CloseHandle.KERNEL32 ref: 00007FF76D67DADE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67DB67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D67DB6D

Strings

ntdll.dll, xrefs: 00007FF76D67D683
File, xrefs: 00007FF76D67D87C
NtDuplicateObject, xrefs: 00007FF76D67D693

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Handle$CriticalQuerySection$CloseEnterInformationProcessSystem_invalid_parameter_noinfo_noreturn$AddressCurrentFinalLeaveModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2860019875-3955674919
Opcode ID: 21da06c63f2867e29d3588a8774fc642046e8667a66b00752823b9a86500d6e1
Instruction ID: dc65820b35533f076c43d67567e88385088d7296f0b9ebfd5d7e69742881ffd0
Opcode Fuzzy Hash: 21da06c63f2867e29d3588a8774fc642046e8667a66b00752823b9a86500d6e1
Instruction Fuzzy Hash: 3AE18062F2CA85CAFB00EF65D4543BCA363BB84BD8F844531DA4D17B99EF38A1458750

Function 00007FF76D5F60C0 Relevance: 25.2, Strings: 20, Instructions: 208COMMON

Download Yara Rule

Strings

$recycle.bin, xrefs: 00007FF76D5F60E8
Boot, xrefs: 00007FF76D5F6160
All users, xrefs: 00007FF76D5F6384
System Volume Information, xrefs: 00007FF76D5F6186
#recycle, xrefs: 00007FF76D5F6139
ProgramData, xrefs: 00007FF76D5F6355
$windows.~ws, xrefs: 00007FF76D5F6299
$windows.~bt, xrefs: 00007FF76D5F621E
$winreagent, xrefs: 00007FF76D5F626D
Windows.old, xrefs: 00007FF76D5F61F8
PerfLogs, xrefs: 00007FF76D5F6244
Windows.~bt, xrefs: 00007FF76D5F62C8
ntldr, xrefs: 00007FF76D5F6326
Program Files (x86), xrefs: 00007FF76D5F6411
Program Files, xrefs: 00007FF76D5F63E2
Application Data, xrefs: 00007FF76D5F61AC
AppData, xrefs: 00007FF76D5F62F7
bootmgr, xrefs: 00007FF76D5F63B3
config.msi, xrefs: 00007FF76D5F61D2
Windows, xrefs: 00007FF76D5F6111

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: #recycle$$recycle.bin$$windows.~bt$$windows.~ws$$winreagent$All users$AppData$Application Data$Boot$PerfLogs$Program Files$Program Files (x86)$ProgramData$System Volume Information$Windows$Windows.old$Windows.~bt$bootmgr$config.msi$ntldr
API String ID: 73155330-2722463023
Opcode ID: 09db10df498b887c42b6ddd2bb1ccb86b1b81dbdf6e64d0b75542c00bd61434b
Instruction ID: d2876c659f7f4c5ec7864016b3945ddb502a8bb3dc0daaa99d8ec49d48c42273
Opcode Fuzzy Hash: 09db10df498b887c42b6ddd2bb1ccb86b1b81dbdf6e64d0b75542c00bd61434b
Instruction Fuzzy Hash: E5A19652D78BCA84E710EB34D8513F59362BBEA388FA06336E54C65856FF68B2D4C341

Function 00007FF76D6A0E74 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1203COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF76D6A0EC3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6A14F6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6A166C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6A1928
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6A1B48
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6A1D83
memcpy_s.LIBCPMT ref: 00007FF76D6A1E5E
memcpy_s.LIBCPMT ref: 00007FF76D6A1F09
memcpy_s.LIBCPMT ref: 00007FF76D6A1FD9

Part of subcall function 00007FF76D68C304: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D68C336

Strings

1#QNAN, xrefs: 00007FF76D6A0FDF
1#INF, xrefs: 00007FF76D6A0FEF
1#IND, xrefs: 00007FF76D6A0FB3
1#SNAN, xrefs: 00007FF76D6A0FD6

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: d3ac3c9e6f2a3cc9299820455b8d5a62efe305f74d449836c4ee372b45885f05
Instruction ID: 0106327d1f3974c0cc5d6816845cd8234cac0508f597dd61e1db6836d2e2ceaf
Opcode Fuzzy Hash: d3ac3c9e6f2a3cc9299820455b8d5a62efe305f74d449836c4ee372b45885f05
Instruction Fuzzy Hash: 60B2B372E2C282CAE7649F65D5407FDB6A2FB543C4F985135DA4A57E88EB3CE900CB10

Function 00007FF76D663CC0 Relevance: 21.6, APIs: 7, Strings: 5, Instructions: 630COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D664671
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D664677
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D66467D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D664683
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D664689
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D66468F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D664695

Strings

[nargs: , xrefs: 00007FF76D6644E2, 00007FF76D664503
[nargs=, xrefs: 00007FF76D664527
[required], xrefs: 00007FF76D6645D1
or more] , xrefs: 00007FF76D66451E
[default: , xrefs: 00007FF76D664594

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: or more] $[default: $[nargs: $[nargs=$[required]
API String ID: 3668304517-2670406794
Opcode ID: 4a7ee4e35fed00e19effd432ee15140a84a88d2486dc642c3fe506a6750980aa
Instruction ID: bd9c3d5e951f7e2b907103807551241d5544184a0f7c8afb78e38c7e1fac6a04
Opcode Fuzzy Hash: 4a7ee4e35fed00e19effd432ee15140a84a88d2486dc642c3fe506a6750980aa
Instruction Fuzzy Hash: A152A362E2CB81C1EB10EBA5E4542ADA772EB897D4F945236DA5D137D9EF7CE080C310

Function 00007FF76D62BEE0 Relevance: 21.6, APIs: 8, Strings: 4, Instructions: 608COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62C979
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62C995
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62C99B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62C9A1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62C9A7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62C9AD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D62C9B9

Strings

content, xrefs: 00007FF76D62C653
filename, xrefs: 00007FF76D62C494
exists, xrefs: 00007FF76D62C96C
directory_iterator::directory_iterator, xrefs: 00007FF76D62C988

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 3668304517-1400943384
Opcode ID: f1e899b5ea1c157f01f1dea9f895bd1c5d1e3a652249b1b41e1ccae9a2354e0f
Instruction ID: f510a58f519b17762f7dbb16d3abad13b83e4f9ef3c9ae7f7c07333aeb344e3c
Opcode Fuzzy Hash: f1e899b5ea1c157f01f1dea9f895bd1c5d1e3a652249b1b41e1ccae9a2354e0f
Instruction Fuzzy Hash: 26527172A29BC5C9DB209F24D8403ED7362FB89798F945231DA9D07B99EF78D284C710

Function 00007FF76D659600 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 363COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF76D65985A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6598EF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6598F5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6598FB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D659901
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D659907

Strings

value, xrefs: 00007FF76D65A536
parse_error, xrefs: 00007FF76D65968C

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: parse_error$value
API String ID: 1944019136-1739288027
Opcode ID: 8596453e50a0a1da90bf6cbcc496ddab7ca13a6123127e71acc5a9c59b74262f
Instruction ID: f39c86675da396c400a7c72eb8e41153e2ecca430772ae8e28dd362d09e51b9b
Opcode Fuzzy Hash: 8596453e50a0a1da90bf6cbcc496ddab7ca13a6123127e71acc5a9c59b74262f
Instruction Fuzzy Hash: 15F1B362F2CA86C5EB00EB64D4512FDA323EB553D8F805632EA5C1699AFF7CE185C350

Function 00007FF76D67E0A0 Relevance: 12.8, APIs: 8, Instructions: 839stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D67DD50: RtlAcquirePebLock.NTDLL ref: 00007FF76D67DD93
Part of subcall function 00007FF76D67DD50: NtAllocateVirtualMemory.NTDLL ref: 00007FF76D67DDC8
Part of subcall function 00007FF76D67DD50: lstrcpyW.KERNEL32 ref: 00007FF76D67DE2A
Part of subcall function 00007FF76D67DD50: lstrcatW.KERNEL32 ref: 00007FF76D67DEE1

CoInitializeEx.OLE32 ref: 00007FF76D67E105
lstrcpyW.KERNEL32 ref: 00007FF76D67E30E
lstrcatW.KERNEL32 ref: 00007FF76D67E545
CoGetObject.OLE32 ref: 00007FF76D67E561
lstrcpyW.KERNEL32 ref: 00007FF76D67ECC1
lstrcatW.KERNEL32 ref: 00007FF76D67EF22
CoGetObject.OLE32 ref: 00007FF76D67EF3E
CoUninitialize.OLE32 ref: 00007FF76D67F4B2

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: lstrcatlstrcpy$Object$AcquireAllocateInitializeLockMemoryUninitializeVirtual
String ID:
API String ID: 3636535045-0
Opcode ID: b7bfeffe4e490a9624e5010149ae55799967800886d82e80360165d1231289cd
Instruction ID: 25321c5615f10928810748e2bbc0a0820ef8c68a20653760973ba8d456e4c07c
Opcode Fuzzy Hash: b7bfeffe4e490a9624e5010149ae55799967800886d82e80360165d1231289cd
Instruction Fuzzy Hash: AFB2673652AFC58AD7A18F29E88169AB3A4F789784F105225FFCD57F18EF34C2548740

Function 00007FF76D664EF0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 431COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D6A54E0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D6A5510
Part of subcall function 00007FF76D6A54E0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D6A5516

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6653F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6653FD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6655C7

Strings

shows help message and exits, xrefs: 00007FF76D6651CB
--help, xrefs: 00007FF76D665124
prints version information and exits, xrefs: 00007FF76D6652DC
--version, xrefs: 00007FF76D665235

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: --help$--version$prints version information and exits$shows help message and exits
API String ID: 3936042273-1172229024
Opcode ID: 63d5cc829c311e8b9aac001e537e6ac372537cc762d3cabc515976ba405c58a2
Instruction ID: 3b3e3c0a990d60b07fa7aa5f4f42b352a108645127df94529c62b03be7e0497b
Opcode Fuzzy Hash: 63d5cc829c311e8b9aac001e537e6ac372537cc762d3cabc515976ba405c58a2
Instruction Fuzzy Hash: 3E229932A18B81C5E710DF64E4407ADB7B6FB98788F949235DA8C13B6AEF78D195C300

Function 00007FF76D688A38 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF76D688AB1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF76D688AC9
RtlVirtualUnwind.KERNEL32 ref: 00007FF76D688B04
IsDebuggerPresent.KERNEL32 ref: 00007FF76D688B3D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF76D688B47
UnhandledExceptionFilter.KERNEL32 ref: 00007FF76D688B52

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 35bf856a41f19bc8ee7b8f5e42e7dc75e2a598134c0ac36b1a8c304357de2300
Instruction ID: a1aeb42e1f60711326853ce9fffe1aba6f76e0964c722c0bc1fa50c31c45627e
Opcode Fuzzy Hash: 35bf856a41f19bc8ee7b8f5e42e7dc75e2a598134c0ac36b1a8c304357de2300
Instruction Fuzzy Hash: C4317136A18F81C5DB60DF25E8442ADB3A5FB84794F940136EA8D43B69EF3CC5458B50

Function 00007FF76D68BE00 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF76D68BE6A
memcpy_s.LIBCPMT ref: 00007FF76D68BE95

Strings

, xrefs: 00007FF76D68BFC8

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: 1b748593274e8ddd9ac1e908b2a22b3d8043b10f383cd2471e7c6bd1e5b959b4
Instruction ID: 22e789f8e4b5f3588e3fb1f5caafe2b3785d691cf0749accd628f16f440fd5d8
Opcode Fuzzy Hash: 1b748593274e8ddd9ac1e908b2a22b3d8043b10f383cd2471e7c6bd1e5b959b4
Instruction Fuzzy Hash: 15C1C872A2D686C7D720DF59E084A69F7A2F7847C4F858235DB4A43784EB3DE805CB20

Function 00007FF76D6849BA Relevance: 6.9, Strings: 5, Instructions: 634COMMON

Download Yara Rule

Strings

value, xrefs: 00007FF76D685398
object key, xrefs: 00007FF76D684F8A, 00007FF76D6852D9
object separator, xrefs: 00007FF76D684EDE, 00007FF76D685221
array, xrefs: 00007FF76D6850B1
object, xrefs: 00007FF76D685169

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: __std_exception_destroy$_invalid_parameter_noinfo_noreturn
String ID: array$object$object key$object separator$value
API String ID: 2506729964-2448007618
Opcode ID: 7c18b47fa51d52272e91b6058e1f2322e3705fc6374010a1bf9b3daa432aa964
Instruction ID: 0a859e3f5f0853443a265f0e1ebf70a39d497dd6e4770907f4c7999d656a6ac5
Opcode Fuzzy Hash: 7c18b47fa51d52272e91b6058e1f2322e3705fc6374010a1bf9b3daa432aa964
Instruction Fuzzy Hash: 2642A522E2C686D5EB00EF34C4511FDA362EB957C4F806532EA0E5769AFF6CE185C360

Function 00007FF76D668FD0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 499COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6692B7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6695A3

Strings

%, xrefs: 00007FF76D6695DE

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: %
API String ID: 3668304517-2567322570
Opcode ID: f8dd17bd03a9ed5b7083d2af580c5c7e25fdb9617f08cc871f9a5d060bb4ec21
Instruction ID: 4a73da7a15e370576702c448aa9b2b01c9672a64d43c9d81af1720703ce38d57
Opcode Fuzzy Hash: f8dd17bd03a9ed5b7083d2af580c5c7e25fdb9617f08cc871f9a5d060bb4ec21
Instruction Fuzzy Hash: 7A120022F2C6C5CAFB259BA4D4103FDA772AB58788F844136DE4D27B89EE3CD4458361

Function 00007FF76D6ABC84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,?,?,?,?,00000000,00007FF76D61DF29), ref: 00007FF76D6ABCAA
FormatMessageA.KERNEL32 ref: 00007FF76D6ABCD9

Strings

!x-sys-default-locale, xrefs: 00007FF76D6ABC9D

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: e03368e1294968a7be98b08cf2acdcb8e5506132744e7f119a71bf8ca3b046b3
Instruction ID: 1942832bff2d54458731b9edbd2f58fcb7dd7f4f11735a18c9faf68423215149
Opcode Fuzzy Hash: e03368e1294968a7be98b08cf2acdcb8e5506132744e7f119a71bf8ca3b046b3
Instruction Fuzzy Hash: A3018C72E2CB8582E7219B11F4507A9ABA2FB897D4F848135DA8912A98DF3CD445CB10

Function 00007FF76D646F70 Relevance: 5.0, APIs: 3, Instructions: 460COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D646FEA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D646FF0

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: dcec567ba59e0678dfe92466f97399e346d882922d2dfdc879b2baf602a7689e
Instruction ID: 900e5ce0e5b76f8b6d7a6b6224e79fd542d1ccc1d0984adbd459bcb5a6f4f519
Opcode Fuzzy Hash: dcec567ba59e0678dfe92466f97399e346d882922d2dfdc879b2baf602a7689e
Instruction Fuzzy Hash: 9602A262F28B81C5EB10EFA5D0442ADA372EB48BD4F948232DE5D17795EF38E495C390

Function 00007FF76D627C80 Relevance: 4.6, APIs: 3, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FF76D627D0D
LocalFree.KERNEL32 ref: 00007FF76D627D9F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D627E86

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2610421622-0
Opcode ID: fe922275ff4f7ed3ae722bdf4a1dbeb117267567780c805f8d684a0cdb6c988d
Instruction ID: f0acb9fa356ca777b19e3a625050cb6a164f4043d59c49441775ad4ea0663362
Opcode Fuzzy Hash: fe922275ff4f7ed3ae722bdf4a1dbeb117267567780c805f8d684a0cdb6c988d
Instruction Fuzzy Hash: 3C616D32F28A81CAF710DF74D4503ADB3A2EB5879CF444635EA8C16E89EF78D5948360

Function 00007FF76D666D70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 506COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D66750D

Strings

-, xrefs: 00007FF76D667031

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: -
API String ID: 3668304517-2547889144
Opcode ID: f6a5f4831f5460d119c130d630406cbaa068cdcb1508787f5bc61b02de43d130
Instruction ID: b2253ee50cdd5c8ca38d6a86b990176b2ac1e2884e4726b9dba95fb94334582c
Opcode Fuzzy Hash: f6a5f4831f5460d119c130d630406cbaa068cdcb1508787f5bc61b02de43d130
Instruction Fuzzy Hash: 7E228F22E28BC1C6EB10DF65D4402ADA7B6FB457D8F945631EA5C27B99EF38E480C350

Function 00007FF76D6950AC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF76D691E9E), ref: 00007FF76D695120

Strings

GetLocaleInfoEx, xrefs: 00007FF76D6950C8, 00007FF76D6950D9

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 3e7302eb2a7978fa3031c2e08be01dfce33e44987349fbcc01d6c54447146e53
Instruction ID: 47a7a6895b9c82ac167c336a68a6fb9a81dc42e23553ee868e72bab57722b1d2
Opcode Fuzzy Hash: 3e7302eb2a7978fa3031c2e08be01dfce33e44987349fbcc01d6c54447146e53
Instruction Fuzzy Hash: 7701A720F1C742C5E744AB56B4404BAE762EF84BD0F944036DE1D477A9EE3CD9418750

Function 00007FF76D6666D0 Relevance: 3.4, APIs: 2, Instructions: 361COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D666C11
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D666C17

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 5b6fbd3d6831e130143ad7c389dd4d0c595e2b1e576dfdc38dac454ea813c2a2
Instruction ID: 7ab0f3e31bf3b739d867fefb6c7ca745a5a94955322bbcce53bf05e79f2413fa
Opcode Fuzzy Hash: 5b6fbd3d6831e130143ad7c389dd4d0c595e2b1e576dfdc38dac454ea813c2a2
Instruction Fuzzy Hash: 59E1A222E2CBD1C1EB109BA5E44436DAB62FB44BD8F844275DE9D23AD5EF78E4808351

Function 00007FF76D66F620 Relevance: 3.2, APIs: 2, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D66F9AB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D66F9B1

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d96a3f2f4de2cb4b2b56d7c3ba2d51a1e2ecacb634fa478f72dd04fa704fd67b
Instruction ID: b2357d042ac16423b6e4a2dbda734aef059ae8426695e907c10be9f58d645956
Opcode Fuzzy Hash: d96a3f2f4de2cb4b2b56d7c3ba2d51a1e2ecacb634fa478f72dd04fa704fd67b
Instruction Fuzzy Hash: 58A18122E2CBC5C2EB14DB56E10436DA7B2FB557C4F849235DA8C16A96EF7CE4C08310

Function 00007FF76D698C2C Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF76D698E7B
RaiseException.KERNEL32 ref: 00007FF76D698E8C

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: b71f1d3c42e610c0face707ee20cd6d6a88a4c4d18c7a9917a4b3c1b6102180a
Instruction ID: a4539c6c2781d27d6106dd0518a423a1f94f280bf1e6c3894a46fd8c370be77e
Opcode Fuzzy Hash: b71f1d3c42e610c0face707ee20cd6d6a88a4c4d18c7a9917a4b3c1b6102180a
Instruction Fuzzy Hash: D8B16D73A18B45CBEB19CF29C44236877A2F784B88F548972DA5D87BB8DB39D811C710

Function 00007FF76D69762C Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF76D6977B6
e+000, xrefs: 00007FF76D697739

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: da619a2ec6fb2360145ee9bd85d1454833031957d55182a0f8e54245fbbe8895
Instruction ID: 83fb34c59484f2716da1d93d128ded03724224dbf4f2485d5a4df02bc2820cd2
Opcode Fuzzy Hash: da619a2ec6fb2360145ee9bd85d1454833031957d55182a0f8e54245fbbe8895
Instruction Fuzzy Hash: AF515B62F2C2C6C6E7249A359800769A793E744BD4F888271DB984FAD5EF7DD8418720

Function 00007FF76D65DBD0 Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D65DEEC

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 7d491843c00690ab696a29fdecfd2c4cba183d24c7fa3f37e1d8bca5ef92b61c
Instruction ID: 607e7695b7889c01160581e45c7ddb8b17961c527292e5d2920da9091c087521
Opcode Fuzzy Hash: 7d491843c00690ab696a29fdecfd2c4cba183d24c7fa3f37e1d8bca5ef92b61c
Instruction Fuzzy Hash: 77A19D22A19B99C9EB00CB69D4803AC7771F759788F948536CF8D53B95EF38D091C360

Function 00007FF76D65D590 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D65D8A4

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: bad8c727b8ff3d655bc053341c37552273949757c92367f1c0688fc43b61d822
Instruction ID: 5b4eb90eb8fd60c0768624a40c3481c8941fdb5c1ffee9a5c5c344e1cdaa800c
Opcode Fuzzy Hash: bad8c727b8ff3d655bc053341c37552273949757c92367f1c0688fc43b61d822
Instruction Fuzzy Hash: 4BA18C22B29B96C9EB00DBA9D4803ACA771F758788F948436CF8D57795EF38D091C360

Function 00007FF76D65CF60 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D65D258

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 13417d2202afd287088bb860e0e320552aa8449e36adbd92f8f41a755ee18e82
Instruction ID: 145e765c341c7ca391e4f42f3519eb3a5dc74b5dd62e798b97c4cf4516756703
Opcode Fuzzy Hash: 13417d2202afd287088bb860e0e320552aa8449e36adbd92f8f41a755ee18e82
Instruction Fuzzy Hash: D8A1CD62B29B99C9EB10CB69D4803ACA771F759788F948436CF8D17B95EF38D091C360

Function 00007FF76D65DF00 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D65E1F8

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: fba7f4fde73bfc44a27cf012c7902ea7c5bcbac1e6c10f5ba2ec33225ba79af6
Instruction ID: 7eaeab5e41266c4c8cf39fd9d8b121273b29ac1b53d81e3e9be839fdc6a0d46c
Opcode Fuzzy Hash: fba7f4fde73bfc44a27cf012c7902ea7c5bcbac1e6c10f5ba2ec33225ba79af6
Instruction Fuzzy Hash: 1CA18A62B19B99C9EB10CB69D4803ACA771F758788F948436CF8D57B96EF38D091C360

Function 00007FF76D6B3BC0 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF76D6B3C23

Part of subcall function 00007FF76D6AE91C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6AE930

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: c18a0d9b03aae947ae56912f7fbd91862cf6e30b660de31e07dea2fef0df8077
Instruction ID: a048bc99ce5894299e7cda4e09b4efd676b404e1a44e14aaafe8e8f5432cd43e
Opcode Fuzzy Hash: c18a0d9b03aae947ae56912f7fbd91862cf6e30b660de31e07dea2fef0df8077
Instruction Fuzzy Hash: 7B611922F2C692C7FB60AA68944077CE6839F407E0FD44236DA2D876C1FF6DE8558760

Function 00007FF76D69FAE4 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF76D6910DC: GetLastError.KERNEL32 ref: 00007FF76D6910EB
Part of subcall function 00007FF76D6910DC: FlsGetValue.KERNEL32 ref: 00007FF76D691100
Part of subcall function 00007FF76D6910DC: SetLastError.KERNEL32 ref: 00007FF76D69118B

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF76D6A02CF,?,00000000,00000092,?,?,00000000,?,00007FF76D691CC5), ref: 00007FF76D69FB82

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 6bbfa0cfbcb117d0d0bd7b1f47d6fbf85da9e61559fd768ec35dd84706e269b8
Instruction ID: c3c129421b2a8ed67905d4bf51f85fe0f20c23fac347b0f41238253e3d852a1a
Opcode Fuzzy Hash: 6bbfa0cfbcb117d0d0bd7b1f47d6fbf85da9e61559fd768ec35dd84706e269b8
Instruction Fuzzy Hash: 251105A3E2C646CAEB149F15D0402A8B7A3EB90BE0F858135E629473D4EE38D9D1C710

Function 00007FF76D64AF00 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

., xrefs: 00007FF76D64B200

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 480c4dd7c12b5ca5eff3fd6117f446d7c26e4b4bccc3cab41be6ea2855e47cbb
Instruction ID: 485a75614e9df17dcfdf4958a245d30f2f52c226213e1beba4b463f93f2320df
Opcode Fuzzy Hash: 480c4dd7c12b5ca5eff3fd6117f446d7c26e4b4bccc3cab41be6ea2855e47cbb
Instruction Fuzzy Hash: 65C16422E2C782C6E760EE29D44817EA3A2FB45BD4F958231DA5D43B95EF7CD849C310

Function 00007FF76D69FBB4 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF76D6910DC: GetLastError.KERNEL32 ref: 00007FF76D6910EB
Part of subcall function 00007FF76D6910DC: FlsGetValue.KERNEL32 ref: 00007FF76D691100
Part of subcall function 00007FF76D6910DC: SetLastError.KERNEL32 ref: 00007FF76D69118B

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF76D6A028B,?,00000000,00000092,?,?,00000000,?,00007FF76D691CC5), ref: 00007FF76D69FC32

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 20f033303a7f43631ab577e4b8c174f2a0670d8761bb9d685c12eeb3ee4fc0cb
Instruction ID: f965fcd10999871ed65bc14936e6afb08b2efa251bb2dda8a1059f21693a3204
Opcode Fuzzy Hash: 20f033303a7f43631ab577e4b8c174f2a0670d8761bb9d685c12eeb3ee4fc0cb
Instruction Fuzzy Hash: B301D672F2C286C6E7146F15E4407A9B293EB40BE4F868271E6294B2C4EF6C98D28710

Function 00007FF76D694B68 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF76D694FBB,?,?,?,?,?,?,?,?,00000000,00007FF76D69F130), ref: 00007FF76D694BB7

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 91facb745afbc2f4637f145e0eb14d72f4a938eed1d470420a8036ca57912e6f
Instruction ID: 53ab8a5bb7648b023c752ce2a91022c748d82c2f2081af991ccfed866c7911c9
Opcode Fuzzy Hash: 91facb745afbc2f4637f145e0eb14d72f4a938eed1d470420a8036ca57912e6f
Instruction Fuzzy Hash: A6F0697AA1CA42C2E700EB55F8506A9A363EB88BC0F988035DA4D87365EF3CE8518750

Function 00007FF76D68F67C Relevance: 1.5, APIs: 1, Instructions: 27timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF76D68F690

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: b5bbfa824154c3d77187a8a3e5b1d839929f2d5cb3525db48a7388bed245af34
Instruction ID: 1e573fbfc680efb2fd4d0b518bfaf9b177ee20d2ad0e9bba2f5e42fc3353c01b
Opcode Fuzzy Hash: b5bbfa824154c3d77187a8a3e5b1d839929f2d5cb3525db48a7388bed245af34
Instruction Fuzzy Hash: EDF02EA2F3D50983ED04AB1084143289282AF28BE4F105730EE3E0E7D4FE1CD0858320

Function 00007FF76D68E10C Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

, xrefs: 00007FF76D68E2F2

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 0e27038ca049793d61ec5ddb93713cae2a321fb0d894cb179eab7f341e6cf820
Instruction ID: c0e39fa3bb1c3d7f1797cda4081ea2d21cf27ec1ff782d631f9d89f69dfc9a2f
Opcode Fuzzy Hash: 0e27038ca049793d61ec5ddb93713cae2a321fb0d894cb179eab7f341e6cf820
Instruction Fuzzy Hash: 39B19172E2C745C6E7649F29C45413CBBA2E70AB88FA40135DA4D87396EF3AD841C731

Function 00007FF76D6AEFD0 Relevance: .6, Instructions: 634COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5325b933501e752e53b4993b7539b7d02dad47a23dec996b8a144fc4eb4aaf5
Instruction ID: 3308c578a4509136a5975a0797fe47f687937b43019ce6927fc0823b658472d9
Opcode Fuzzy Hash: c5325b933501e752e53b4993b7539b7d02dad47a23dec996b8a144fc4eb4aaf5
Instruction Fuzzy Hash: 89626121D3DE56C5E253AF35B461531A366BF5A3C4F818333E84E66A51FF6CB8628320

Function 00007FF76D66F9C0 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042c13a15fea5a2a1b7fd401a9e4f90c7abfb219e0802bb1e0a5658ac4d56ca8
Instruction ID: 05b0b7208705cce98c73acb09c6e3cc471f794fef25a04b59ebe38610bb16671
Opcode Fuzzy Hash: 042c13a15fea5a2a1b7fd401a9e4f90c7abfb219e0802bb1e0a5658ac4d56ca8
Instruction Fuzzy Hash: 1F02D312E2CAC2C2EB109B65D1002BAA362FB55BC8F449634DF5D67686EF3CF5D18351

Function 00007FF76D68E9A4 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7c041a1ddcf11e25cf0bb9e41c031e648fd4e482a102b9d07c79ecb8b8e1b7
Instruction ID: ccc9ba560c98b18f0a78b47b6c96ae35988fa366b2bdbd2ef9c44365460c4bb6
Opcode Fuzzy Hash: 1b7c041a1ddcf11e25cf0bb9e41c031e648fd4e482a102b9d07c79ecb8b8e1b7
Instruction Fuzzy Hash: 25D1D762E2C646C5EB74AB29810027DA7A2FB44BC8F940135DE5D877D6EF3AE446C370

Function 00007FF76D691B14 Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 88e75c18b578dfe027ebcec4b74e3b6c1c05ca8ec6d9b2d69b7d7db6122ddb3f
Instruction ID: 698ace65bd26c1c2093ed95a28e848bd10dce1ddff074798d4abd8002d1ed26f
Opcode Fuzzy Hash: 88e75c18b578dfe027ebcec4b74e3b6c1c05ca8ec6d9b2d69b7d7db6122ddb3f
Instruction Fuzzy Hash: 94C1D725E2C687C5EB60AB2194107BAA7ABFB847C8F904071DE4D4BA99FF3CD905C310

Function 00007FF76D6899EC Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4fbf5227913e0886a99989058a49bce39a7f5bda817c3bb378f8f909cfd4537
Instruction ID: 7af6982d62d355a6d96b831ab988e75c729f3beb52d4045adfe0049abb3bac50
Opcode Fuzzy Hash: c4fbf5227913e0886a99989058a49bce39a7f5bda817c3bb378f8f909cfd4537
Instruction Fuzzy Hash: 1D912922F3C542CAFA256E2994503BA96D2AF407DCF841536DE5E477C4FE2CE809D634

Function 00007FF76D65FE50 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94abd17858a29da6604f084abc8ede15cb37ad89f40817780fbb3ade52cfd43
Instruction ID: 9e53b51b4ecae7e0da0961a35d3804fed28955d2f6f9517d6d64b8ff12375d0e
Opcode Fuzzy Hash: b94abd17858a29da6604f084abc8ede15cb37ad89f40817780fbb3ade52cfd43
Instruction Fuzzy Hash: 409191B7A246808FD354CF19E440A4ABBA4F3C8B48F51E615EF8593B14E739DA06CF40

Function 00007FF76D6AEB50 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8d80873ac15429934d4afb07094e68f7099b14570073c19eee78c38702d7cc11
Instruction ID: 9f6ace4af0c56ec48e61e3f592fc2fc9e66afeb5177586823f515a356173b9a0
Opcode Fuzzy Hash: 8d80873ac15429934d4afb07094e68f7099b14570073c19eee78c38702d7cc11
Instruction Fuzzy Hash: 6781B232F18A51C5EB60EE25C49137D63A2FB44BD8F844636DE6E87B96EF38D4458310

Function 00007FF76D697CAC Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f10e5c36d2c90e3e843d3ee526e322415ff32a223bae658752ee0c55110d05
Instruction ID: b72552a8706b69aa905cb40269c12c7a94a1fae115a59014534fba180b3e8c12
Opcode Fuzzy Hash: 03f10e5c36d2c90e3e843d3ee526e322415ff32a223bae658752ee0c55110d05
Instruction Fuzzy Hash: AD81E272E2C782C5E764DB19A44037AB693FB457D4F904235DA8D4BB99EE3CE8088B10

Function 00007FF76D63CB90 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec938e2278b14a04dbb626e947d484f460c30e86730ef98d8f8e7ce8a528cec
Instruction ID: b050eb0058eb12cd341e5baaf3b64476ddf112b6ab2799f52395b4ad8f9a294b
Opcode Fuzzy Hash: 5ec938e2278b14a04dbb626e947d484f460c30e86730ef98d8f8e7ce8a528cec
Instruction Fuzzy Hash: ED61CA72F296A9C2EE209B1DD4455B8A362FB547D4F87A231EA5E07784EF7CE180C310

Function 00007FF76D68DAC4 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65988544bd8c51d46c1f2ecd44d2c2020be5c6c9d2ff497e3ff94f9df2993759
Instruction ID: 48f0836d6c0cef8f2d4e09406eeaf5ed7f4909c3b1dc80cfc0bc3be4b8e962d5
Opcode Fuzzy Hash: 65988544bd8c51d46c1f2ecd44d2c2020be5c6c9d2ff497e3ff94f9df2993759
Instruction Fuzzy Hash: 465196B3E2C551CAE728AF25D05433CA762EB95BA8F540136CE4917799EF28EC41CB70

Function 00007FF76D68D6F4 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15eac905c6263da8fcd042729b4cf6c2eac0663125a33ca76778ac8e5de10585
Instruction ID: 5b7ca40877f13df9d0e80e944129583a3599f21ad03e5611d8a06af7bbcefc01
Opcode Fuzzy Hash: 15eac905c6263da8fcd042729b4cf6c2eac0663125a33ca76778ac8e5de10585
Instruction Fuzzy Hash: 72518476E2C551CAE728AF28C05433CA762EB95B98F544136CE4D17799EF28EC42CB70

Function 00007FF76D63FDF9 Relevance: 37.2, APIs: 10, Strings: 11, Instructions: 427COMMON

Download Yara Rule

Strings

key declared, but no value, xrefs: 00007FF76D641337, 00007FF76D64135A, 00007FF76D64145C
No closed word, xrefs: 00007FF76D6413E7, 00007FF76D64140A
Unexpected eof, xrefs: 00007FF76D6412CA
key opened, but never closed, xrefs: 00007FF76D64147F
quote was opened but not closed., xrefs: 00007FF76D641314, 00007FF76D64137D
word wasnt properly ended, xrefs: 00007FF76D64142D, 00007FF76D6414A8
object is not closed with '}', xrefs: 00007FF76D6412F1
unexpected key without object, xrefs: 00007FF76D6413BE
/, xrefs: 00007FF76D640002
*, xrefs: 00007FF76D64003B
unexpected '}', xrefs: 00007FF76D6414CB

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID: *$/$No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 0-1642088037
Opcode ID: 4955307820b7bf9e95779d9d6c0d7a91414760f1bd60af515bdb3cc33e576e82
Instruction ID: 14bc237f7ca4a1761eab19ac8ac063716230e71e42cfd8191f41e181567c3126
Opcode Fuzzy Hash: 4955307820b7bf9e95779d9d6c0d7a91414760f1bd60af515bdb3cc33e576e82
Instruction Fuzzy Hash: FE129662E2CA86D4EB60EF24D8442E9A362FF447C8FC49432D65D07AA5FE7CD599C310

Function 00007FF76D63FD10 Relevance: 35.3, APIs: 11, Strings: 9, Instructions: 341COMMON

Download Yara Rule

Strings

key declared, but no value, xrefs: 00007FF76D641337, 00007FF76D64135A, 00007FF76D64145C
No closed word, xrefs: 00007FF76D6413E7, 00007FF76D64140A
Unexpected eof, xrefs: 00007FF76D6412CA
key opened, but never closed, xrefs: 00007FF76D64147F
quote was opened but not closed., xrefs: 00007FF76D641314, 00007FF76D64137D
word wasnt properly ended, xrefs: 00007FF76D64142D, 00007FF76D6414A8
object is not closed with '}', xrefs: 00007FF76D6412F1
unexpected key without object, xrefs: 00007FF76D6413BE
unexpected '}', xrefs: 00007FF76D6414CB

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID: No closed word$Unexpected eof$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 0-2490624340
Opcode ID: d5d9abe7fd30bb05289e982250562a2d0cc516ea7e00891d84855f64588a5f90
Instruction ID: f8ac53b032802774504873840b35ebd599a5e34e74ec3d686eacf692727f3e79
Opcode Fuzzy Hash: d5d9abe7fd30bb05289e982250562a2d0cc516ea7e00891d84855f64588a5f90
Instruction Fuzzy Hash: DBF14122E2CA86D4EB60EF24E8542E9A362FB543C8FC45532E65D069A5FF7CD199C310

Function 00007FF76D662B90 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 137COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D662D56
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D662D5C

Strings

ios_base::badbit set, xrefs: 00007FF76D662B34
ios_base::eofbit set, xrefs: 00007FF76D662B46
runas, xrefs: 00007FF76D66288B
ios_base::failbit set, xrefs: 00007FF76D662B3F
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 00007FF76D66248B
temp_directory_path, xrefs: 00007FF76D662B0B
.exe, xrefs: 00007FF76D66241B
open, xrefs: 00007FF76D662882
.exe, xrefs: 00007FF76D662444

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .exe$.exe$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas$temp_directory_path
API String ID: 3668304517-3845196099
Opcode ID: f65187cc1a08519a886eb721e53edc390a223561ecd8446332388138ded36300
Instruction ID: b398a7586b8707a3c49eb8f1f819fe386e5299b3efce2d160d43989734491823
Opcode Fuzzy Hash: f65187cc1a08519a886eb721e53edc390a223561ecd8446332388138ded36300
Instruction Fuzzy Hash: 0A518322F2DA81C4FB10EBA4D4401BDA772AF487D4F985635DE5C23A99FF78E4818320

Function 00007FF76D6910DC Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF76D6910EB
FlsGetValue.KERNEL32 ref: 00007FF76D691100
FlsSetValue.KERNEL32 ref: 00007FF76D691121
FlsSetValue.KERNEL32 ref: 00007FF76D69114E
FlsSetValue.KERNEL32 ref: 00007FF76D69115F
FlsSetValue.KERNEL32 ref: 00007FF76D691170
SetLastError.KERNEL32 ref: 00007FF76D69118B
FlsGetValue.KERNEL32 ref: 00007FF76D6911C1
FlsSetValue.KERNEL32 ref: 00007FF76D6911E0

Part of subcall function 00007FF76D694ABC: HeapAlloc.KERNEL32(?,?,00000000,00007FF76D6912B6,?,?,8000000000000000,00007FF76D68D1D5,?,?,?,?,00007FF76D696E44,?,?,?), ref: 00007FF76D694B11

FlsSetValue.KERNEL32 ref: 00007FF76D691208

Part of subcall function 00007FF76D694454: RtlFreeHeap.NTDLL(?,?,?,00007FF76D69E5C2,?,?,?,00007FF76D69E93F,?,?,00000000,00007FF76D69C67C,?,?,?,00007FF76D69C5AF), ref: 00007FF76D69446A
Part of subcall function 00007FF76D694454: GetLastError.KERNEL32(?,?,?,00007FF76D69E5C2,?,?,?,00007FF76D69E93F,?,?,00000000,00007FF76D69C67C,?,?,?,00007FF76D69C5AF), ref: 00007FF76D694474

FlsSetValue.KERNEL32 ref: 00007FF76D691219
FlsSetValue.KERNEL32 ref: 00007FF76D69122A

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 5c63d7d18e4e6ebad16c3a7f6c7ebd9b6b334e9cfda971f594c1aa4185fbf8d7
Instruction ID: 7a1261ab9d1453454d1504df122a1a4c0c973fefadff63ed4be8715af9e03e69
Opcode Fuzzy Hash: 5c63d7d18e4e6ebad16c3a7f6c7ebd9b6b334e9cfda971f594c1aa4185fbf8d7
Instruction Fuzzy Hash: 06415E24E2C603C1FA68B36199511B9D2475F887F0FA847B9E93D4F6D6FE6CBC418224

Function 00007FF76D688EE8 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D688F17
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D688FED

Strings

0, xrefs: 00007FF76D68901C
0, xrefs: 00007FF76D68902E
0, xrefs: 00007FF76D6890EB
0, xrefs: 00007FF76D6890D5

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0$0
API String ID: 3215553584-3558443385
Opcode ID: d608b9ccb3a1d19eeeea9c07fe447e196d3edbd60470f6c5e29c92132ad38802
Instruction ID: bd6ab183432421755300aca8694e64cb732821c9aff63fb5b9d78c407d211758
Opcode Fuzzy Hash: d608b9ccb3a1d19eeeea9c07fe447e196d3edbd60470f6c5e29c92132ad38802
Instruction Fuzzy Hash: 1DF1D732D2D686C9F761AE1584542BDBBA2AB56BC8FC48033C78D477D2EE2D94558330

Function 00007FF76D655DC0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 365COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D65631A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D656320
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D656326
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D65632C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D656332

Strings

syntax error , xrefs: 00007FF76D655DFD
; last read: ', xrefs: 00007FF76D655FEC
while parsing , xrefs: 00007FF76D655E66
unexpected , xrefs: 00007FF76D656177
; expected , xrefs: 00007FF76D656277

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ; expected $; last read: '$syntax error $unexpected $while parsing
API String ID: 3668304517-4239264347
Opcode ID: 4681162154355e39811ff480a9e67447bde77904a510e332cb30c837dcb95219
Instruction ID: 84a606573a117e880507be6dabaf2c324cc64534696710650c73cca2e11c3b2e
Opcode Fuzzy Hash: 4681162154355e39811ff480a9e67447bde77904a510e332cb30c837dcb95219
Instruction Fuzzy Hash: 8AF1B072F28681C8FB10EBA5D4443AC6B73AB007A8FA15235DE1C17AD9EF7890C5C350

Function 00007FF76D6AC564 Relevance: 16.7, APIs: 11, Instructions: 171COMMON

Download Yara Rule

APIs

__std_fs_open_handle.LIBCPMT ref: 00007FF76D6AC5A4

Part of subcall function 00007FF76D6AC50C: CreateFileW.KERNEL32 ref: 00007FF76D6AC53F
Part of subcall function 00007FF76D6AC50C: GetLastError.KERNEL32 ref: 00007FF76D6AC54E

SetFileInformationByHandle.KERNEL32 ref: 00007FF76D6AC5CE
__std_fs_open_handle.LIBCPMT ref: 00007FF76D6AC606
CloseHandle.KERNEL32 ref: 00007FF76D6AC620
GetLastError.KERNEL32 ref: 00007FF76D6AC654
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF76D6AC6A0
GetLastError.KERNEL32 ref: 00007FF76D6AC6AE
CloseHandle.KERNEL32 ref: 00007FF76D6AC6C4
SetFileInformationByHandle.KERNEL32 ref: 00007FF76D6AC6F0
SetFileInformationByHandle.KERNEL32 ref: 00007FF76D6AC724
GetLastError.KERNEL32 ref: 00007FF76D6AC746

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Handle$File$ErrorInformationLast$Close__std_fs_open_handle$Create
String ID:
API String ID: 45822711-0
Opcode ID: ac255b92f54e0decef66a81c590786349c7e4f825fb4b82c92da3dc8683901ab
Instruction ID: 7527bf6c27250a0dd0da3866a65ca038692dbc1e957ede4d483e816430e8cd30
Opcode Fuzzy Hash: ac255b92f54e0decef66a81c590786349c7e4f825fb4b82c92da3dc8683901ab
Instruction Fuzzy Hash: 3761E539F2C642C9F720EB7548145BCA7A26B457E8F9D1234CD6B56ED8EF2CE4018720

Function 00007FF76D61F690 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D6ABDE8: AreFileApisANSI.KERNEL32(?,?,?,?,00007FF76D63DE88,?,?,?,?,?,00000000,FFFFFFFF,?,?,00007FF76D621F0A), ref: 00007FF76D6ABDFA

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D61F8F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D61F8F6
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF76D61F987

Strings

: ", xrefs: 00007FF76D61F798
", ", xrefs: 00007FF76D61F7CB

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ApisFile__std_exception_destroy
String ID: ", "$: "
API String ID: 397665139-747220369
Opcode ID: 4808c2f4d7ba51b5eba26e56e868f074b75028db4d12b02ae2aae601284c77e8
Instruction ID: b91f7952dfe516b77b21d52d455987c6fe07c1e9bda130e1e609c86c2b523d35
Opcode Fuzzy Hash: 4808c2f4d7ba51b5eba26e56e868f074b75028db4d12b02ae2aae601284c77e8
Instruction Fuzzy Hash: D8A1AE72F28A41C5EB00EF69E4543ADA362EB48BC8F908531DA5D07B9AEF7CD495C350

Function 00007FF76D66CB80 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 173COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76D66CBFE
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF76D66CC47
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D66CDC3
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D66CDD6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D66CDDC

Strings

true, xrefs: 00007FF76D66CCFB
bad locale name, xrefs: 00007FF76D66CDC9
false, xrefs: 00007FF76D66CCCE

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 5d1174ca7e0bab63a7590be40b9ba473c4e59d368f8aee5d261ff5225ac7570d
Instruction ID: c871ab244ad78d39e6e511bd67bac0fdbe974a750a4e02094efc99610489fd15
Opcode Fuzzy Hash: 5d1174ca7e0bab63a7590be40b9ba473c4e59d368f8aee5d261ff5225ac7570d
Instruction Fuzzy Hash: CA716022E1DB41CAEB10EFA1E4502AD77B6EF84784F550134DE8D27A95EF38E425C364

Function 00007FF76D665850 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D665F0C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D665F68
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D665F6E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D665F7A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D665F80
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D665F86

Strings

No such argument: , xrefs: 00007FF76D665F3A

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: No such argument:
API String ID: 3936042273-4085609673
Opcode ID: 79abb65eb93aa6a136fdcb700339065af4210c5badc938cf3c7f1f184e35faa3
Instruction ID: eb414e5b720c1e938aeab9836d87d4c65712fae9fba271848e0ceb18a620aa5a
Opcode Fuzzy Hash: 79abb65eb93aa6a136fdcb700339065af4210c5badc938cf3c7f1f184e35faa3
Instruction Fuzzy Hash: 16129172F2C6C1C5FB10ABA5D4053BDA372AB487E8F844635DE5C27ADAEE78D1808351

Function 00007FF76D694BE4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,00000000,00007FF76D695292,?,?,00000030,00007FF76D69BF50,?,?,?,?,?,?,?), ref: 00007FF76D694D63
GetProcAddress.KERNEL32(?,00000000,00007FF76D695292,?,?,00000030,00007FF76D69BF50,?,?,?,?,?,?,?), ref: 00007FF76D694D6F

Strings

ext-ms-, xrefs: 00007FF76D694CC0
api-ms-, xrefs: 00007FF76D694CAD

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: ea1db75ad569a1f751d6f236fcb11e3532b51c7e1c493ad09dd3763442c21a1b
Instruction ID: 250fb1c41179cd6cede11d52f9a38180c07797446e22b1848ba2ea518504e5b1
Opcode Fuzzy Hash: ea1db75ad569a1f751d6f236fcb11e3532b51c7e1c493ad09dd3763442c21a1b
Instruction Fuzzy Hash: D041C425F2DA03C1EB11AB16A8041B5A397BF49BE0F884135DD2D8B794FE7CF8498264

Function 00007FF76D636F90 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF76D637171
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6371FB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D637201
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D637207
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D63720D

Strings

other_error, xrefs: 00007FF76D637000

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: other_error
API String ID: 1944019136-896093151
Opcode ID: 4b15cb577bf646d70d5b569f81aeae6c6e8bfd0d5b8ad027f23cd0faa020be58
Instruction ID: 0f50f9f4e94541c612f57282cad72bce57ba001b053af13716d57d0b1b3c3a11
Opcode Fuzzy Hash: 4b15cb577bf646d70d5b569f81aeae6c6e8bfd0d5b8ad027f23cd0faa020be58
Instruction Fuzzy Hash: 6B718362F28B46C5FB00DF75D4503ED6362AB553D8F809331DA5C16AD9FE789195C310

Function 00007FF76D65B9F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF76D65BBD1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D65BC5B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D65BC61
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D65BC67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D65BC6D

Strings

out_of_range, xrefs: 00007FF76D65BA60

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$__std_exception_copy
String ID: out_of_range
API String ID: 1944019136-3053435996
Opcode ID: 2e5b05abdf5ab5c2e7fc40b45ad401c18c58e3f5f029ac3bdc37ca94060cc540
Instruction ID: f726beb57a8aac2cf33efc656165706c06e65e0980a009b1a16967f95cf75cec
Opcode Fuzzy Hash: 2e5b05abdf5ab5c2e7fc40b45ad401c18c58e3f5f029ac3bdc37ca94060cc540
Instruction Fuzzy Hash: 04718062F28B86C8FB00DF78D4503EDA362AB553D8F809731DA5C16AD9FE78A195C310

Function 00007FF76D6A2E64 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF76D6A2E95
GetLastError.KERNEL32 ref: 00007FF76D6A2EA1
CloseHandle.KERNEL32 ref: 00007FF76D6A2EB9
CreateFileW.KERNEL32 ref: 00007FF76D6A2EE4
WriteConsoleW.KERNEL32 ref: 00007FF76D6A2F03

Strings

CONOUT$, xrefs: 00007FF76D6A2EC5

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3e87a9d24b09cb7ed727a1284b1e7e38199b0e79d20510dbc5928c805aadcfb1
Instruction ID: ec2c721d3c46a9f22c3211df07d41714d397cabbee79bde8218fa63216863ca7
Opcode Fuzzy Hash: 3e87a9d24b09cb7ed727a1284b1e7e38199b0e79d20510dbc5928c805aadcfb1
Instruction Fuzzy Hash: 4411B431E2CB41C2E3609B56E854325A3A2FB58FE0F440234EA5D83BA4EF7CD8008B50

Function 00007FF76D6ADEE4 Relevance: 9.2, APIs: 6, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF76D6ADF8D
MultiByteToWideChar.KERNEL32 ref: 00007FF76D6AE030
MultiByteToWideChar.KERNEL32 ref: 00007FF76D6AE0D1
MultiByteToWideChar.KERNEL32 ref: 00007FF76D6AE11B
MultiByteToWideChar.KERNEL32 ref: 00007FF76D6AE1B2
CompareStringEx.KERNEL32 ref: 00007FF76D6AE1E5

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 1f222af0314fcbf6c58ca9d58d599dac593cbc3de6a245fd672c9df98935204f
Instruction ID: 8bbd51e9b1ab77624479f57c5266fa535c852aa7f5f02b3444face72b53305a7
Opcode Fuzzy Hash: 1f222af0314fcbf6c58ca9d58d599dac593cbc3de6a245fd672c9df98935204f
Instruction Fuzzy Hash: D1A1A322F2C692C5EB30AB1594503BAA793AF447E4F8C4231D99D46FD6FE7CE8508720

Function 00007FF76D6ADB88 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF76D6ADBFA
MultiByteToWideChar.KERNEL32 ref: 00007FF76D6ADCA2
LCMapStringEx.KERNEL32 ref: 00007FF76D6ADCD9
LCMapStringEx.KERNEL32 ref: 00007FF76D6ADD32
LCMapStringEx.KERNEL32 ref: 00007FF76D6ADDDF
WideCharToMultiByte.KERNEL32 ref: 00007FF76D6ADE21

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 1f3243329c99890ad18f8a7cec79f33d9315a9a6983336c811db799711a53098
Instruction ID: ce326a933d4556dd793e5f44740b3deda4b6be39c68a12c03f8bac0d8434d3ec
Opcode Fuzzy Hash: 1f3243329c99890ad18f8a7cec79f33d9315a9a6983336c811db799711a53098
Instruction Fuzzy Hash: E1816272A28742C6EB60AF119440369A692FB94BE8F980235EE9D17BD4FF7CD8458710

Function 00007FF76D671A50 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF76D671A93
EnterCriticalSection.KERNEL32(?,?,?,00007FF76D671A24), ref: 00007FF76D671AA5
EnterCriticalSection.KERNEL32 ref: 00007FF76D671AB5
GdiplusShutdown.GDIPLUS ref: 00007FF76D671AC3
LeaveCriticalSection.KERNEL32 ref: 00007FF76D671AD0
LeaveCriticalSection.KERNEL32 ref: 00007FF76D671ADA

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 30679f12dbbd152e61c0fe2a4bbedbaa7e9dfe4d4c4f42536384a88b64d7b78a
Instruction ID: b84fb640ab520dbd2dd26507917c7d254af847277a587794c9b48f491dee5d75
Opcode Fuzzy Hash: 30679f12dbbd152e61c0fe2a4bbedbaa7e9dfe4d4c4f42536384a88b64d7b78a
Instruction Fuzzy Hash: 1F112B32D29B52C5EB10AF25E850068B3A9FF44FA4B984236DA5D026B4EF3DD896C750

Function 00007FF76D6380E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76D63814F
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF76D638197
_Getcoll.LIBCPMT ref: 00007FF76D6381CB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6382CA

Strings

bad locale name, xrefs: 00007FF76D6382D0

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::__invalid_parameter_noinfo_noreturn
String ID: bad locale name
API String ID: 818938248-1405518554
Opcode ID: 9b8325ff8bc74863a41d4be75a682b880fe8c1739dd87e699f09f246b040dfe4
Instruction ID: 30e0e89b40a835f0ca70f409c8cea13278d0760a92244bb3e49031f69f6624f5
Opcode Fuzzy Hash: 9b8325ff8bc74863a41d4be75a682b880fe8c1739dd87e699f09f246b040dfe4
Instruction Fuzzy Hash: 08719E22F19B41CAFB10EFB0D4503EC7362AF44B98F845135DE5D67AA9EE38D45183A4

Function 00007FF76D67A650 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF76D67A6DB

Strings

?, xrefs: 00007FF76D67A690

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: d7e1ae92a0908e142731b4cf36fff3df5c3d7e532b959394d8cd6afee606e306
Instruction ID: 58b92e419ee663d2934fff1e763964406ea3c9aa1cc57a10a57549cef48d1f42
Opcode Fuzzy Hash: d7e1ae92a0908e142731b4cf36fff3df5c3d7e532b959394d8cd6afee606e306
Instruction Fuzzy Hash: F541B332E2C785C1EB10DB25F44476AB362FB947D4F901235EA9D02A99EF7CD084CB40

Function 00007FF76D68FB88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF76D68FBAD
GetProcAddress.KERNEL32 ref: 00007FF76D68FBC3
FreeLibrary.KERNEL32 ref: 00007FF76D68FBEA

Strings

mscoree.dll, xrefs: 00007FF76D68FBA4
CorExitProcess, xrefs: 00007FF76D68FBBC

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e91dbd054835129bd37fca78440ae2e4d78f62940abb7a5c67c7a2dd2baeef04
Instruction ID: 68283c4521f38640fafc15d7cacd7d7c9266762e53753d66575de3633dcf3324
Opcode Fuzzy Hash: e91dbd054835129bd37fca78440ae2e4d78f62940abb7a5c67c7a2dd2baeef04
Instruction Fuzzy Hash: 59F06265F2DA02C1EB20AB24E459379A362EF897E5FD40635C66E466F4EF3CD044CB60

Function 00007FF76D689524 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D68959D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6895ED
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D689635
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D68966D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6896E0

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ba78767d69c567f9d7c1615b8af23bd7b3554ffd0ebaa4639307bd7a69fb353b
Instruction ID: 9c5a54ee198763b96e5f75d7c572e846fe1b523f57c36e755191374466aba420
Opcode Fuzzy Hash: ba78767d69c567f9d7c1615b8af23bd7b3554ffd0ebaa4639307bd7a69fb353b
Instruction Fuzzy Hash: 90519722D2D746C6F7526F25A45027DBBD6AF51B8CFC88032C68D07346EE2D9445C732

Function 00007FF76D63A600 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 289COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D63A819
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D63A825
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D63AA21

Strings

0:, xrefs: 00007FF76D63A8FB

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: 0:
API String ID: 3936042273-4252728285
Opcode ID: 4d6422c0ed559fec9df3e2ec1cab29afe91ce2d7270e1fdc8ef3114d2a04624e
Instruction ID: f043ef423a8ea8110bf1ae4b5cbf17851affbac8457f7926ee10b63665efac36
Opcode Fuzzy Hash: 4d6422c0ed559fec9df3e2ec1cab29afe91ce2d7270e1fdc8ef3114d2a04624e
Instruction Fuzzy Hash: 61C17C32E28B818AEB10DF65E8402ADB3B5F759798F455635DF8D13B59EF78E0A08310

Function 00007FF76D647080 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 246COMMON

Download Yara Rule

Strings

ios_base::badbit set, xrefs: 00007FF76D6470E7
ios_base::eofbit set, xrefs: 00007FF76D6470F9
ios_base::failbit set, xrefs: 00007FF76D6470F2

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: ec5111274b0a19fe5499515a09df4fafe80ec9ab2c4b91590fe775fc4f3bae1c
Instruction ID: 5ecb8bc82093d9115bf8221ed8d539628b819b7831aa44cd40fa81934b531a56
Opcode Fuzzy Hash: ec5111274b0a19fe5499515a09df4fafe80ec9ab2c4b91590fe775fc4f3bae1c
Instruction Fuzzy Hash: F9919C72E28A85C1EB14DB11E45836EB366FB44BC4FA48432EA9D47B94EF38C495C390

Function 00007FF76D665F90 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 216COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D6662D8

Strings

Subcommands:, xrefs: 00007FF76D666166
Optional arguments:, xrefs: 00007FF76D6660EF
Positional arguments:, xrefs: 00007FF76D66607E

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: Optional arguments:$Positional arguments:$Subcommands:
API String ID: 3668304517-2031040180
Opcode ID: 64d2db2aadb8d65ec33f7ec2082bb7302e0c41f167e730c8a20a573962193ca2
Instruction ID: 36872285867f07e852bc2752a1971da1c4c2f76bd899de5e840e09b48e43be42
Opcode Fuzzy Hash: 64d2db2aadb8d65ec33f7ec2082bb7302e0c41f167e730c8a20a573962193ca2
Instruction Fuzzy Hash: 2AA18B62E2CA81C1EB14EB95E4403BDA763EB44BC4F849036DA0D17796EF7CD585C3A1

Function 00007FF76D672CC0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__std_fs_get_current_path.LIBCPMT ref: 00007FF76D672D38

Part of subcall function 00007FF76D6AC0FC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF76D6AC104

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D672EDA

Part of subcall function 00007FF76D61FA60: __std_exception_copy.LIBVCRUNTIME ref: 00007FF76D61FAED

Strings

--type, xrefs: 00007FF76D672CCB
current_path(), xrefs: 00007FF76D672EE0

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: CurrentDirectory__std_exception_copy__std_fs_get_current_path_invalid_parameter_noinfo_noreturn
String ID: --type$current_path()
API String ID: 2526998938-584980331
Opcode ID: 545f012f757a79460f80532e936a5fb941bcb4a6abbea2a18c132f2fa72ec685
Instruction ID: 3d3b21c07f986a55a8f764b777957c3c2f19cf6ce9b7a9c3dbd9a72b362bd3ff
Opcode Fuzzy Hash: 545f012f757a79460f80532e936a5fb941bcb4a6abbea2a18c132f2fa72ec685
Instruction Fuzzy Hash: 0C519162F24755C9FB20DBB4D8406AC77B2FB48798F904235EE5967B98EF389485C310

Function 00007FF76D667E8A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00007FF76D667FC7

Part of subcall function 00007FF76D65F820: CoInitializeEx.OLE32 ref: 00007FF76D65F8CE

OpenMutexA.KERNEL32 ref: 00007FF76D6680CF
ExitProcess.KERNEL32 ref: 00007FF76D6680DF

Strings

APPB:, xrefs: 00007FF76D667F62
--type, xrefs: 00007FF76D667E9E
--key, xrefs: 00007FF76D667EE9

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ExitProcess$InitializeMutexOpen
String ID: --key$--type$APPB:
API String ID: 3710457153-2541764812
Opcode ID: f0dad4a55aebe92829e22db305535894228dfd5e9c5921f9cb9629a2b4d59aba
Instruction ID: b26028075e382b3a1ae0935c4085062a346c0aed75d5246b76da192de9b47167
Opcode Fuzzy Hash: f0dad4a55aebe92829e22db305535894228dfd5e9c5921f9cb9629a2b4d59aba
Instruction Fuzzy Hash: DD214D21E2CAC6E1EA21BB60E4512FAE362EF943C4FC05031D68D5799AFF6CD549C750

Function 00007FF76D6ABD98 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF76D6AC482), ref: 00007FF76D6ABDAE
GetProcAddress.KERNEL32(?,?,?,00007FF76D6AC482), ref: 00007FF76D6ABDBE

Strings

GetTempPath2W, xrefs: 00007FF76D6ABDB7
kernel32.dll, xrefs: 00007FF76D6ABDA7

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32.dll
API String ID: 1646373207-1846531799
Opcode ID: 6f9f3995978003d1ccc8dec992d9ad662db8d21aec809d3de5c822f6ec52e1f4
Instruction ID: 9f8def26436b2a5d09bb9bb6c7caf500501cdeb7c676bbf57d90f22f3bbc69c5
Opcode Fuzzy Hash: 6f9f3995978003d1ccc8dec992d9ad662db8d21aec809d3de5c822f6ec52e1f4
Instruction Fuzzy Hash: E9E0ED61F2CE42C1EA15AB05F954065A362EF487C0B888035D90D47334EE3CD4558B20

Function 00007FF76D6B3E38 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6B3E79
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6B3EF9
_invalid_parameter_noinfo.LIBCMT ref: 00007FF76D6B3F4D
_get_daylight.LIBCMT ref: 00007FF76D6B3FA5

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 7f2af6dd734c9f49134f5f6cb4caa58708795f3dc7952dab5fe11fe3ab74a09c
Instruction ID: 9e08211834f7f6b8b5a307d040b05ccc03bd1454516d486a65d98e5f639ea77e
Opcode Fuzzy Hash: 7f2af6dd734c9f49134f5f6cb4caa58708795f3dc7952dab5fe11fe3ab74a09c
Instruction Fuzzy Hash: D151D332F2C203C7F7697A289500379EEA6EF40394F994436DA4D462D6FE7CE8608671

Function 00007FF76D63DD8E Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a9753c5dd5aaecb0f08403194d8510e73776db33929aef7eaf97357db8d0d5
Instruction ID: abcf0588383ca8f4b17fb7c54f00e3ea44fcdcc5d446c21a2c854372f8ff33cf
Opcode Fuzzy Hash: 60a9753c5dd5aaecb0f08403194d8510e73776db33929aef7eaf97357db8d0d5
Instruction Fuzzy Hash: 2B411922F2C64686EA24AF25A440279E292AF917D4F481634EF9D07BD6FF7CE0918710

Function 00007FF76D655A80 Relevance: 6.1, APIs: 4, Instructions: 147COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D655BD8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D655BDE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D655BE4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D655C4C

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: c8d8352de661bcc564db49fef8c4ac3b9240e22af63d4045dcd91f7aa2624c67
Instruction ID: 1ae26c7906c9d33f4391eaa6409f641e3633b32d57813cfcedf41dcec5cf850e
Opcode Fuzzy Hash: c8d8352de661bcc564db49fef8c4ac3b9240e22af63d4045dcd91f7aa2624c67
Instruction Fuzzy Hash: D4518C72B29B85C1EE04EF64E05827CA366FB44FD4F944636DA9C07A99EF2CD4A0C340

Function 00007FF76D631D90 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D6AD090: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76D6AD0AD
Part of subcall function 00007FF76D6AD090: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF76D6AD0D0

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76D631DD1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76D631DF6
std::_Facet_Register.LIBCPMT ref: 00007FF76D631EA2
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D631F04

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: cd937c2163436b9fb287f8dcd4740911990055bdb6793be5d7727d4a2ed8b4cb
Instruction ID: 4fd658e15c241975651562ff5639029649df6f70da0e7935bcdbfa76b9362b24
Opcode Fuzzy Hash: cd937c2163436b9fb287f8dcd4740911990055bdb6793be5d7727d4a2ed8b4cb
Instruction Fuzzy Hash: 4A416136E2CB41C1EA10EB15E4502BAB3A6FB44BD0F991531EA9D43795EF7CE451C720

Function 00007FF76D633BC0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76D633BEB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76D633C10
std::_Facet_Register.LIBCPMT ref: 00007FF76D633CBB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D633D06

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 0369a9c64f1772f6bca1fded505bf389f4c46f7af8db3148ec6ac7e1e0e24fe9
Instruction ID: 5184421119845be54d9140d86ba149302f6148b92b1ad489e682afb733a134c8
Opcode Fuzzy Hash: 0369a9c64f1772f6bca1fded505bf389f4c46f7af8db3148ec6ac7e1e0e24fe9
Instruction Fuzzy Hash: 47416525E2CA41C1EA15EB19E4402B9A362FB84BD4F8D1531EA9D47BA5EF7CE441C720

Function 00007FF76D66C6F0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76D66C71B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76D66C740
std::_Facet_Register.LIBCPMT ref: 00007FF76D66C7EB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D66C836

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: e9aed6b30e84fad8b38908f104a3c73bb54b038ef3e6a91cf5d8b68b06daa922
Instruction ID: 85d7004932d70cda3b4128064679fd5ca020e72d8e1d9ee9c18b7e5c5b6026a7
Opcode Fuzzy Hash: e9aed6b30e84fad8b38908f104a3c73bb54b038ef3e6a91cf5d8b68b06daa922
Instruction Fuzzy Hash: 5C416235E2DE42C1EA10EF55E4402B9AB62FB48BD4F9D0131DA8E576A5EE3CE441C721

Function 00007FF76D66C5A0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76D66C5CB
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76D66C5F0
std::_Facet_Register.LIBCPMT ref: 00007FF76D66C69B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF76D66C6E6

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 5a318f1a63269f86f6f01977b281ee29954bdc37aff602f150dafae79cdb3a6a
Instruction ID: ef3353598764f355c56604397967347564a687c471ee1e98959de7a046c52681
Opcode Fuzzy Hash: 5a318f1a63269f86f6f01977b281ee29954bdc37aff602f150dafae79cdb3a6a
Instruction Fuzzy Hash: 77418425E2DE42C1EA10EF55E4502B9A762FB48BD4F891131DB8E876A5EE3CE441C721

Function 00007FF76D6ABF7C Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF76D6ABFC5
GetLastError.KERNEL32 ref: 00007FF76D6ABFD3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF76D633E79), ref: 00007FF76D6AC008
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF76D633E79), ref: 00007FF76D6AC016

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: a35a7af96b277efd2b3ef8961dad066aa662e8996eab021f8be0da18f0958b31
Instruction ID: b6bbdd75c4002778dbd7a4571d5da5626b42696b6308865ecd07ff3bd4ce9084
Opcode Fuzzy Hash: a35a7af96b277efd2b3ef8961dad066aa662e8996eab021f8be0da18f0958b31
Instruction Fuzzy Hash: 36212976A28B95C6E3609F16E44432EBBB5F788BC4F640138DB8953B64EF3DD8118B50

Function 00007FF76D6ABD20 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

SetFileInformationByHandle.KERNEL32 ref: 00007FF76D6ABD40
GetLastError.KERNEL32 ref: 00007FF76D6ABD4A
SetFileInformationByHandle.KERNEL32 ref: 00007FF76D6ABD7D
GetLastError.KERNEL32 ref: 00007FF76D6ABD87

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ErrorFileHandleInformationLast
String ID:
API String ID: 275135790-0
Opcode ID: ef666a5330756d5a635ca31cfb1b723dc77e2aec855cfe130d87bc9277cbf906
Instruction ID: bae13f3df7053ab3ac4a50aa1b9c5983a34b0242a07d069a62fd32f7593c5f10
Opcode Fuzzy Hash: ef666a5330756d5a635ca31cfb1b723dc77e2aec855cfe130d87bc9277cbf906
Instruction Fuzzy Hash: BCF0D631E3C542C2F7A4BB7894686B8A792DF057C0F980134C58A42DA4FF3DE9888720

Function 00007FF76D64B520 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF76D63DD8E: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF76D63DEDD
Part of subcall function 00007FF76D63DD8E: __std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF76D63DF15

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64B741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D64B747

Strings

exists, xrefs: 00007FF76D64B734

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: __std_fs_convert_narrow_to_wide_invalid_parameter_noinfo_noreturn
String ID: exists
API String ID: 522447391-2996790960
Opcode ID: a6848dfe8cbe46310abd85f92e8c869361070070a400ed4726469f5d07cfcf06
Instruction ID: 7703a77fa49835e49cc099a1e4cdc3d3eb29a89257833314c6c6ceab2e8cd2af
Opcode Fuzzy Hash: a6848dfe8cbe46310abd85f92e8c869361070070a400ed4726469f5d07cfcf06
Instruction Fuzzy Hash: DB517172F28A42C9EB00EFA9D4442EC7323EB487E8F809635DA5D17A99EE38D155C350

Function 00007FF76D66CDF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF76D66CE5E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF76D66CEA6

Strings

bad locale name, xrefs: 00007FF76D66CF7B

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 1ad9c77ffd22072e2417aa3a4302156ab4d7865e908e4005bab9a5b36d6378d2
Instruction ID: 66c18543cdd97b08ac055401ac4759bac69a91f0bc3a71de05079f9032a1c81b
Opcode Fuzzy Hash: 1ad9c77ffd22072e2417aa3a4302156ab4d7865e908e4005bab9a5b36d6378d2
Instruction Fuzzy Hash: 18516C32F29A41C9EB10EFB0E4902B8B775EF54B88F880435EA4E26A55EE38D555C364

Function 00007FF76D699C24 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF76D69ECAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF76D69ECDF

_get_daylight.LIBCMT ref: 00007FF76D699D3C
_get_daylight.LIBCMT ref: 00007FF76D699D4D

Strings

?, xrefs: 00007FF76D699CCD

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 474fd3e1ec55746607e6cbbec746fddb0031a9f286cfcaa57028f77b386b185d
Instruction ID: dc348cd32eb8997cccdd8e8dc8e87436f04849982c46103880e7308a76f23732
Opcode Fuzzy Hash: 474fd3e1ec55746607e6cbbec746fddb0031a9f286cfcaa57028f77b386b185d
Instruction Fuzzy Hash: 5F410812E2C743C6FB24AB259441379E6A3EB80BE8F545276EE5C0AAD5EF3CD845C710

Function 00007FF76D693E14 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF76D693F2B
GetLastError.KERNEL32 ref: 00007FF76D693F4D

Strings

U, xrefs: 00007FF76D693ED7

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: bee17eca91563b03ee591555d47daf55e6df060aa8ca0c42c3912dffb49774b0
Instruction ID: fb87325200e463e4956424805e88442a1153f82a92aad7f905ef5733d3d21620
Opcode Fuzzy Hash: bee17eca91563b03ee591555d47daf55e6df060aa8ca0c42c3912dffb49774b0
Instruction Fuzzy Hash: D2418222A2CA42C1DB60AF65E4443A9A7A2FB987D4F854031EE4D87B58EF3CD841C750

Function 00007FF76D66B870 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF76D66B9B6

Strings

true, xrefs: 00007FF76D66B891
false, xrefs: 00007FF76D66B898

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: false$true
API String ID: 3668304517-2658103896
Opcode ID: efb35b21473e905b062275266f2c6b4fc1117c4455827efe1fd332045f7f9afa
Instruction ID: bf2d4e6cc1cd2caed597f7258ed7a6888e5f19282f2a5213773213439df3e0cc
Opcode Fuzzy Hash: efb35b21473e905b062275266f2c6b4fc1117c4455827efe1fd332045f7f9afa
Instruction Fuzzy Hash: E8417263F28B85D9FB00DFB8D4403EC6372AB69398F845331EA5C126D9EE689195C310

Function 00007FF76D698F98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF76D698FEC
_set_errno_from_matherr.LIBCMT ref: 00007FF76D699059

Strings

exp, xrefs: 00007FF76D698FC7

Memory Dump Source

Source File: 00000000.00000002.2033526040.00007FF76D5F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF76D5F0000, based on PE: true

Associated: 00000000.00000002.2033489908.00007FF76D5F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033639501.00007FF76D6C8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033682785.00007FF76D6F4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033712410.00007FF76D6F6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033744845.00007FF76D6F9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2033779710.00007FF76D6FD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff76d5f0000_mSLEwIfTGL.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: 4150a5858f8c1529622c9a3be3afac75e5a34536c3a73a8c8f4fb5056da0edb7
Instruction ID: 2f5b835163cb35e272a7001a36e3d1687e2e0fc462473b5f72fca0e9920fd9e2
Opcode Fuzzy Hash: 4150a5858f8c1529622c9a3be3afac75e5a34536c3a73a8c8f4fb5056da0edb7
Instruction Fuzzy Hash: 69212D36E28616CEE750DF78D4406AD77B2FB48788F801535FA0D96B49EF38E9418B50

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mSLEwIfTGL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

HTTPS Proxied Packets

Statistics

Windows Analysis Report
mSLEwIfTGL.exe

Function 00007FF76D679310 Relevance: 59.9, APIs: 33, Strings: 1, Instructions: 374
windowCOMMON

Function 00007FF76D67BA60 Relevance: 50.4, APIs: 19, Strings: 9, Instructions: 1387
COMMON

Function 00007FF76D6677F0 Relevance: 39.1, APIs: 18, Strings: 4, Instructions: 585
COMMON

Function 00007FF76D62D510 Relevance: 35.9, APIs: 17, Strings: 3, Instructions: 864
libraryloaderCOMMON

Function 00007FF76D651A80 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 571
COMMON

Function 00007FF76D6AC138 Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 00007FF76D621D4E Relevance: 27.1, APIs: 10, Strings: 5, Instructions: 804
COMMON

Function 00007FF76D62C9C0 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 668
COMMON

Function 00007FF76D682150 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 421
COMMON

Function 00007FF76D678210 Relevance: 19.9, APIs: 13, Instructions: 431
networkCOMMON

Function 00007FF76D678A50 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 377
networkfileCOMMON

Function 00007FF76D62E5A0 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 324
processCOMMON

Function 00007FF76D671B00 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192
windowCOMMON

Function 00007FF76D673030 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 193
networkCOMMON

Function 00007FF76D67B136 Relevance: 16.9, APIs: 11, Instructions: 377
COMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre