Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1543491
MD5:	eab6ffe7b3ed8b11859e3c2858cb1b48
SHA1:	c825fcb349ed78c6fe437605ef17a9c1ab76fc32
SHA256:	ddff18268a87a6d5200836c3219ba973a0e1a60135d5e543cf06d315348ab71b
Tags:	exeuser-Bitsight
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Sets debug register (to hijack the execution of another thread)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain (date check)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

file.exe (PID: 5748 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EAB6FFE7B3ED8B11859E3C2858CB1B48)

conhost.exe (PID: 4920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 3548 cmdline: "C:\Windows\System32\attrib.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "176.124.204.206", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt", "build_name": "mob2", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2249385777.000001CBC4B34000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: attrib.exe PID: 3548	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: attrib.exe PID: 3548	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T01:34:15.307850+0100	2049441	1	A Network Trojan was detected	192.168.2.6	49710	176.124.204.206	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T01:34:15.307850+0100	2050806	1	A Network Trojan was detected	192.168.2.6	49710	176.124.204.206	15666	TCP
2024-10-28T01:34:15.313555+0100	2050806	1	A Network Trojan was detected	192.168.2.6	49710	176.124.204.206	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T01:34:15.307850+0100	2050807	1	A Network Trojan was detected	192.168.2.6	49710	176.124.204.206	15666	TCP
2024-10-28T01:34:15.313555+0100	2050807	1	A Network Trojan was detected	192.168.2.6	49710	176.124.204.206	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.file.exe.7ff684ca4000.1.raw.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "176.124.204.206", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt", "build_name": "mob2", "links": "", "port": 15666}

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 13%
Source: file.exe	Virustotal: Detection: 13%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140073B40 CryptUnprotectData,LocalFree,	2_2_0000000140073B40
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140038060 CryptUnprotectData,LocalFree,	2_2_0000000140038060
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400D7090 CryptUnprotectData,	2_2_00000001400D7090
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400D7098 CryptProtectData,	2_2_00000001400D7098
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140073E40 CryptProtectData,LocalFree,	2_2_0000000140073E40

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.6:49712 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140037350 FindFirstFileW,FindNextFileW,	2_2_0000000140037350
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400BB6BC FindClose,FindFirstFileExW,GetLastError,	2_2_00000001400BB6BC
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400BB76C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	2_2_00000001400BB76C
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400D7100 FindFirstFileW,	2_2_00000001400D7100

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_0000000140082D90 GetLogicalDriveStringsW,

2_2_0000000140082D90

Source: C:\Windows\System32\attrib.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.6:49710 -> 176.124.204.206:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.6:49710 -> 176.124.204.206:15666

Source: global traffic

TCP traffic: 192.168.2.6:49710 -> 176.124.204.206:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 176.124.204.206 176.124.204.206
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: GULFSTREAMUA GULFSTREAMUA

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.6:49710 -> 176.124.204.206:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.204.206

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_0000000140080480 recv,recv,closesocket,WSACleanup,

2_2_0000000140080480

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: attrib.exe, 00000002.00000003.2175011716.000001CBC6811000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248296366.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248418397.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248681142.000001CBC6824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.a.0/sTy
Source: attrib.exe, 00000002.00000003.2175011716.000001CBC6811000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248296366.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248418397.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248681142.000001CBC6824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c.0/ti
Source: attrib.exe, 00000002.00000003.2175011716.000001CBC6811000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248296366.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248418397.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248681142.000001CBC6824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.hotosh
Source: attrib.exe, 00000002.00000003.2175011716.000001CBC6811000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248296366.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248418397.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248681142.000001CBC6824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adoraw-se
Source: attrib.exe, 00000002.00000003.2175011716.000001CBC6811000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248296366.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248418397.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248681142.000001CBC6824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.photo/
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0H
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0I
Source: file.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: file.exe	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2178261280.000001CBC6AF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: attrib.exe, 00000002.00000002.2249385777.000001CBC4B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: attrib.exe, 00000002.00000003.2176826581.000001CBC4BA9000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000002.2249385777.000001CBC4B88000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2179977325.000001CBC4BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189
Source: attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2178261280.000001CBC6AF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2178261280.000001CBC6AF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2178261280.000001CBC6AF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: attrib.exe, 00000002.00000003.2187827583.000001CBC6C49000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: attrib.exe, 00000002.00000003.2181457177.000001CBC6D80000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2187555693.000001CBC6CA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: attrib.exe, 00000002.00000003.2187827583.000001CBC6BB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: attrib.exe, 00000002.00000003.2187827583.000001CBC6BB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: file.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2178261280.000001CBC6AF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: attrib.exe, 00000002.00000003.2181457177.000001CBC6D88000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2182753886.000001CBC7782000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2187827583.000001CBC6BAE000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2181457177.000001CBC6E0B000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2187555693.000001CBC6CA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: attrib.exe, 00000002.00000003.2181457177.000001CBC6D80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org#
Source: attrib.exe, 00000002.00000003.2187827583.000001CBC6BB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: attrib.exe, 00000002.00000003.2187827583.000001CBC6BB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: attrib.exe, 00000002.00000003.2187827583.000001CBC6BB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.6:49712 version: TLS 1.2

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_0000000140081580 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_0000000140081580

Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140086060 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	2_2_0000000140086060
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400D76C0 NtQuerySystemInformation,	2_2_00000001400D76C0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400D76D0 NtAllocateVirtualMemory,LdrEnumerateLoadedModules,	2_2_00000001400D76D0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140085920 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	2_2_0000000140085920

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684CE9620	0_2_00007FF684CE9620
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684CF15F0	0_2_00007FF684CF15F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684D3D9CC	0_2_00007FF684D3D9CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684D2D580	0_2_00007FF684D2D580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684D2DEE0	0_2_00007FF684D2DEE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684CD5680	0_2_00007FF684CD5680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684CDB6B0	0_2_00007FF684CDB6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684CD5250	0_2_00007FF684CD5250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684CD4C20	0_2_00007FF684CD4C20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684CE9BE0	0_2_00007FF684CE9BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684D1CFD0	0_2_00007FF684D1CFD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684CDCF80	0_2_00007FF684CDCF80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684D61380	0_2_00007FF684D61380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684D5EB6C	0_2_00007FF684D5EB6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684CD4530	0_2_00007FF684CD4530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684D1DCF0	0_2_00007FF684D1DCF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684CF14F0	0_2_00007FF684CF14F0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140083040	2_2_0000000140083040
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140063210	2_2_0000000140063210
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140082240	2_2_0000000140082240
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400A22FC	2_2_00000001400A22FC
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140037350	2_2_0000000140037350
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400443F0	2_2_00000001400443F0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140080480	2_2_0000000140080480
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140081580	2_2_0000000140081580
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140088578	2_2_0000000140088578
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400BB76C	2_2_00000001400BB76C
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014007A8F0	2_2_000000014007A8F0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014003D930	2_2_000000014003D930
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014003E9C0	2_2_000000014003E9C0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140083A60	2_2_0000000140083A60
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014008AAE0	2_2_000000014008AAE0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140080CC0	2_2_0000000140080CC0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140098E40	2_2_0000000140098E40
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140088F60	2_2_0000000140088F60
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014009EFBC	2_2_000000014009EFBC
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400C3010	2_2_00000001400C3010
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140007010	2_2_0000000140007010
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140086060	2_2_0000000140086060
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014003F060	2_2_000000014003F060
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400060C0	2_2_00000001400060C0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400970EC	2_2_00000001400970EC
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400A00E4	2_2_00000001400A00E4
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140031130	2_2_0000000140031130
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140050189	2_2_0000000140050189
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014003B1E0	2_2_000000014003B1E0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400A11E4	2_2_00000001400A11E4
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014005B290	2_2_000000014005B290
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400382B0	2_2_00000001400382B0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400322AE	2_2_00000001400322AE
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014006E2C0	2_2_000000014006E2C0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140057300	2_2_0000000140057300
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014003C300	2_2_000000014003C300
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140096344	2_2_0000000140096344
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140072360	2_2_0000000140072360
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400AB398	2_2_00000001400AB398
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400BE400	2_2_00000001400BE400
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140086460	2_2_0000000140086460
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140006480	2_2_0000000140006480
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140078490	2_2_0000000140078490
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140074520	2_2_0000000140074520
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014009652C	2_2_000000014009652C
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400A2578	2_2_00000001400A2578
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014009A5CC	2_2_000000014009A5CC
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400665D0	2_2_00000001400665D0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014006E5F0	2_2_000000014006E5F0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400975F4	2_2_00000001400975F4
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014008D60A	2_2_000000014008D60A
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014009263C	2_2_000000014009263C
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400A6634	2_2_00000001400A6634
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014006A660	2_2_000000014006A660
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140096714	2_2_0000000140096714
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400A0764	2_2_00000001400A0764
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014004E7A9	2_2_000000014004E7A9
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400A97C4	2_2_00000001400A97C4
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140031820	2_2_0000000140031820
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014007C840	2_2_000000014007C840
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014004C870	2_2_000000014004C870
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140006900	2_2_0000000140006900
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014006E910	2_2_000000014006E910
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400299B0	2_2_00000001400299B0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400269C0	2_2_00000001400269C0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014007E9E3	2_2_000000014007E9E3
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014007E9F3	2_2_000000014007E9F3
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140027A00	2_2_0000000140027A00
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140094A50	2_2_0000000140094A50
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400A2B00	2_2_00000001400A2B00
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400A7B08	2_2_00000001400A7B08
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140092B34	2_2_0000000140092B34
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140071B80	2_2_0000000140071B80
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140079BD0	2_2_0000000140079BD0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014006EC30	2_2_000000014006EC30
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014009FC34	2_2_000000014009FC34
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014005CD2D	2_2_000000014005CD2D
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140070D50	2_2_0000000140070D50
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140096D5C	2_2_0000000140096D5C
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140076D60	2_2_0000000140076D60
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014003CDE0	2_2_000000014003CDE0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400AAE2C	2_2_00000001400AAE2C
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140039E39	2_2_0000000140039E39
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140031E50	2_2_0000000140031E50
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140071EB0	2_2_0000000140071EB0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400A5EC4	2_2_00000001400A5EC4
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014004CF20	2_2_000000014004CF20
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014006EF60	2_2_000000014006EF60
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400BDF80	2_2_00000001400BDF80
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_000000014006DFC0	2_2_000000014006DFC0

Source: C:\Windows\System32\attrib.exe	Code function: String function: 0000000140032280 appears 55 times
Source: C:\Windows\System32\attrib.exe	Code function: String function: 000000014002DA30 appears 50 times
Source: C:\Windows\System32\attrib.exe	Code function: String function: 0000000140036EF0 appears 41 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe

Static PE information: Number of sections : 18 > 10

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/1@1/2

Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400878B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,		2_2_00000001400878B0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400D7008 AdjustTokenPrivileges,		2_2_00000001400D7008

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_000000014003E9C0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

2_2_000000014003E9C0

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_00000001400D7720 CoCreateInstance,

2_2_00000001400D7720

Source: C:\Windows\System32\attrib.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963CD40775F
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4920:120:WilError_03

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	ReversingLabs: Detection: 13%
Source: file.exe	Virustotal: Detection: 13%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: wintypes.dll	Jump to behavior

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 1477025 > 1048576

Source: file.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x140a00

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_000000014003D930 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_000000014003D930

Source: file.exe

Static PE information: real checksum: 0x1690d7 should be: 0x174d44

Source: file.exe	Static PE information: section name: .xdata
Source: file.exe	Static PE information: section name: /4
Source: file.exe	Static PE information: section name: /19
Source: file.exe	Static PE information: section name: /31
Source: file.exe	Static PE information: section name: /45
Source: file.exe	Static PE information: section name: /57
Source: file.exe	Static PE information: section name: /70
Source: file.exe	Static PE information: section name: /81

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_0000000140078020 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

2_2_0000000140078020

Source: C:\Windows\System32\attrib.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_2-71570

Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140037350 FindFirstFileW,FindNextFileW,	2_2_0000000140037350
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400BB6BC FindClose,FindFirstFileExW,GetLastError,	2_2_00000001400BB6BC
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400BB76C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	2_2_00000001400BB76C
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400D7100 FindFirstFileW,	2_2_00000001400D7100

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_0000000140082D90 GetLogicalDriveStringsW,

2_2_0000000140082D90

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_0000000140098CE0 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

2_2_0000000140098CE0

Source: C:\Windows\System32\attrib.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: attrib.exe, 00000002.00000002.2249385777.000001CBC4B34000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2176826581.000001CBC4BA9000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000002.2249385777.000001CBC4B88000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2179977325.000001CBC4BA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: attrib.exe, 00000002.00000003.2246844927.000001CBC6C49000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000002.2250160481.000001CBC6C49000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2187827583.000001CBC6C49000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2180361422.000001CBC6C49000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2244587102.000001CBC6C49000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2191849948.000001CBC6C49000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2247908181.000001CBC6C49000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2246418984.000001CBC6C49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: YuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A
Source: attrib.exe, 00000002.00000002.2249385777.000001CBC4B88000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2179977325.000001CBC4BA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: attrib.exe, 00000002.00000003.2179069441.000001CBC6C50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\System32\attrib.exe	API call chain: ExitProcess graph end node			graph_2-71195
Source: C:\Windows\System32\attrib.exe	API call chain: ExitProcess graph end node			graph_2-71200

Source: C:\Windows\System32\attrib.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_0000000140086060 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

2_2_0000000140086060

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_0000000140091688 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_0000000140091688

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_00000001400BD6E0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

2_2_00000001400BD6E0

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_000000014003D930 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_000000014003D930

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_00000001400A9084 GetProcessHeap,

2_2_00000001400A9084

Source: C:\Windows\System32\attrib.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684CA1180 Sleep,Sleep,SetUnhandledExceptionFilter,_set_invalid_parameter_handler,malloc,strlen,malloc,memcpy,_initterm,	0_2_00007FF684CA1180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684CA3111 SetUnhandledExceptionFilter,	0_2_00007FF684CA3111
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF684DE9388 SetUnhandledExceptionFilter,malloc,	0_2_00007FF684DE9388
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_00000001400D72E0 SetUnhandledExceptionFilter,	2_2_00000001400D72E0
Source: C:\Windows\System32\attrib.exe	Code function: 2_2_0000000140091688 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0000000140091688

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\System32\attrib.exe base: 140000000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF684CA1719 GetModuleFileNameA,memset,memset,CreateProcessA,CreateProcessA,GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,puts,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,SetThreadContext,ResumeThread,ResumeThread,

0_2_00007FF684CA1719

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\System32\attrib.exe base: 140000000 value starts with: 4D5A

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\file.exe

Thread register set: target process: 3548

Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Users\user\Desktop\file.exe

Thread register set: 3548 20A6AE70000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\System32\attrib.exe base: 140000000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\System32\attrib.exe base: 140001000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\System32\attrib.exe base: 1400D7000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\System32\attrib.exe base: 140135000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\System32\attrib.exe base: 14013D000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\System32\attrib.exe base: 140144000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\System32\attrib.exe base: 140145000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\System32\attrib.exe base: 140146000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\System32\attrib.exe base: D09B29010	Jump to behavior

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_0000000140076D60 ShellExecuteW,

2_2_0000000140076D60

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\attrib.exe "C:\Windows\System32\attrib.exe"

Jump to behavior

Source: C:\Windows\System32\attrib.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_00000001400A80AC
Source: C:\Windows\System32\attrib.exe	Code function: GetLocaleInfoEx,FormatMessageA,	2_2_00000001400BB330
Source: C:\Windows\System32\attrib.exe	Code function: EnumSystemLocalesW,	2_2_00000001400A83F8
Source: C:\Windows\System32\attrib.exe	Code function: EnumSystemLocalesW,	2_2_00000001400A84C8
Source: C:\Windows\System32\attrib.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00000001400A8560
Source: C:\Windows\System32\attrib.exe	Code function: EnumSystemLocalesW,	2_2_000000014009D620
Source: C:\Windows\System32\attrib.exe	Code function: GetLocaleInfoW,	2_2_00000001400A87AC
Source: C:\Windows\System32\attrib.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00000001400A8904
Source: C:\Windows\System32\attrib.exe	Code function: GetLocaleInfoW,	2_2_00000001400A89B4
Source: C:\Windows\System32\attrib.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00000001400A8AE0
Source: C:\Windows\System32\attrib.exe	Code function: GetLocaleInfoW,	2_2_000000014009DB64

Source: C:\Windows\System32\attrib.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\attrib.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF684CA1450 GetSystemTime,GetCurrentDirectoryA,

0_2_00007FF684CA1450

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_0000000140081B60 GetUserNameW,

2_2_0000000140081B60

Source: C:\Windows\System32\attrib.exe

Code function: 2_2_0000000140083040 GetTimeZoneInformation,

2_2_0000000140083040

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: attrib.exe PID: 3548, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 00000002.00000002.2249385777.000001CBC4B34000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: attrib.exe PID: 3548, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: attrib.exe, 00000002.00000002.2249385777.000001CBC4B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum\wallets
Source: attrib.exe, 00000002.00000002.2249385777.000001CBC4B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: attrib.exe, 00000002.00000003.2177938050.000001CBC4BF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ny1aaXAgMjMuMDEgKHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzNF0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNTVdCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K
Source: attrib.exe, 00000002.00000002.2249385777.000001CBC4B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: attrib.exe, 00000002.00000002.2249385777.000001CBC4B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: attrib.exe, 00000002.00000002.2249385777.000001CBC4B34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\System32\attrib.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: attrib.exe PID: 3548, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 00000002.00000002.2249385777.000001CBC4B34000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: attrib.exe PID: 3548, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Access Token Manipulation	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	611 Process Injection	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	611 Process Injection	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	2 Data from Local System	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Obfuscated Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	23 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	13%	ReversingLabs	Win64.Trojan.SpywareX
file.exe	14%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
api.ipify.org	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ns.adobe.hotosh	attrib.exe, 00000002.00000003.2175011716.000001CBC6811000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248296366.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248418397.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248681142.000001CBC6824000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.adobe.c.0/ti	attrib.exe, 00000002.00000003.2175011716.000001CBC6811000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248296366.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248418397.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248681142.000001CBC6824000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.adoraw-se	attrib.exe, 00000002.00000003.2175011716.000001CBC6811000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248296366.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248418397.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248681142.000001CBC6824000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.photo/	attrib.exe, 00000002.00000003.2175011716.000001CBC6811000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248296366.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248418397.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248681142.000001CBC6824000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.a.0/sTy	attrib.exe, 00000002.00000003.2175011716.000001CBC6811000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248296366.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248418397.000001CBC6820000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2248681142.000001CBC6824000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2178261280.000001CBC6AF8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2178261280.000001CBC6AF8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	attrib.exe, 00000002.00000003.2187827583.000001CBC6C49000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	attrib.exe, 00000002.00000003.2187827583.000001CBC6BB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2178261280.000001CBC6AF8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	attrib.exe, 00000002.00000002.2249385777.000001CBC4B34000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	attrib.exe, 00000002.00000003.2187827583.000001CBC6BB6000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189	attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2178261280.000001CBC6AF8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	attrib.exe, 00000002.00000003.2181457177.000001CBC6D80000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2187555693.000001CBC6CA2000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	attrib.exe, 00000002.00000003.2178063570.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2177693075.000001CBC6B5F000.00000004.00000020.00020000.00000000.sdmp, attrib.exe, 00000002.00000003.2178261280.000001CBC6AF8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	attrib.exe, 00000002.00000003.2188497809.000001CBC6B20000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.124.204.206	unknown	Russian Federation		59652	GULFSTREAMUA	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543491
Start date and time:	2024-10-28 01:33:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/1@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 55 Number of non-executed functions: 136
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
176.124.204.206	SecuriteInfo.com.Win64.PWSX-gen.11198.18925.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	SecuriteInfo.com.Win64.PWSX-gen.20413.18083.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	mSLEwIfTGL.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
172.67.74.152	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	Remittance Receipt.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	SecuriteInfo.com.Win64.Malware-gen.4046.15809.exe	Get hash	malicious	EICAR	Browse	104.26.13.205
	SecuriteInfo.com.Win64.Malware-gen.4046.15809.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	SUNNY HONG VSL PARTICULARS.xlsx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	SecuriteInfo.com.Trojan.Inject5.10837.16335.2292.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Rampage.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	Order Specifications for Materials.docx.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://pub-535a4999ab4b4c1e81647bad9b888e40.r2.dev/onedrivefresh.html	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://ipfox.co.uk/pages/thanks.html#RXJpay5Kb2huc29uQGFnLnN0YXRlLm1uLnVz	Get hash	malicious	Unknown	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GULFSTREAMUA	SecuriteInfo.com.Win64.PWSX-gen.11198.18925.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	176.124.204.206
	SecuriteInfo.com.Win64.PWSX-gen.20413.18083.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	176.124.204.206
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	176.124.204.206
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	176.124.204.206
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	176.124.204.206
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	176.124.204.206
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	176.124.204.206
	mSLEwIfTGL.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	176.124.204.206
	https://darlin.com.au/	Get hash	malicious	Unknown	Browse	176.124.222.157
	LisectAVT_2403002A_415.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	176.124.220.79
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	SecuriteInfo.com.Win32.PWSX-gen.884.23076.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Remittance Receipt.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC	Browse	172.67.170.64
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	https://bit.ly/3Cbulr1	Get hash	malicious	Unknown	Browse	172.67.154.120
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	file.exe	Get hash	malicious	LummaC	Browse	104.21.95.91
	SecuriteInfo.com.Win64.Malware-gen.13500.20938.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	162.159.135.232

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	CQlUZ4KuAa.exe	Get hash	malicious	Vidar	Browse	172.67.74.152
	yt5xqAvHnZ.exe	Get hash	malicious	Vidar	Browse	172.67.74.152
	9yJSTTEg68.exe	Get hash	malicious	Vidar	Browse	172.67.74.152
	f6ffg1sZS2.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.74.152
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	172.67.74.152
	17300406664afe7aec458893633a7734ab1b119dd638ebaf863f6f65e2e732ab9f2f071556149.dat-decoded.exe	Get hash	malicious	Zhark RAT	Browse	172.67.74.152
	wifipr.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	T15hf0Y3mp.lnk	Get hash	malicious	Unknown	Browse	172.67.74.152
	sbOq2d6k2t.lnk	Get hash	malicious	Unknown	Browse	172.67.74.152
	t4GNf3V8mp.exe	Get hash	malicious	Stealc, Vidar	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.068814807123832
Encrypted:	false
SSDEEP:	3:jLt6LI/Q84sB/5qTLjWz:3trrujM
MD5:	C9C7A43D59ED199EB6A356D791B4ACEE
SHA1:	5EE39DFEE4B05429646FB839D602BCD25C5BB090
SHA-256:	5BB69D695BA5ABD8719D81AA3611F0841F41FFB5E840D476BA383444B19F04FA
SHA-512:	A416AEC2F37FB87ACAAB1F0F4565C0582DCE08AEE99140DB10ED58FC9579E147EF111F52383C47C9BFE885CB0850A7AA0CD799A641122A21B597C6E43096C2A9
Malicious:	false
Reputation:	low
Preview:	Downloading.....File downloaded....File cant start now..

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.685369495240918
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'477'025 bytes
MD5:	eab6ffe7b3ed8b11859e3c2858cb1b48
SHA1:	c825fcb349ed78c6fe437605ef17a9c1ab76fc32
SHA256:	ddff18268a87a6d5200836c3219ba973a0e1a60135d5e543cf06d315348ab71b
SHA512:	06f8da78780bd504ad912b1aecfc76b9a4e04ff2b513202fd7ff56ada7a2b60fc74d6c294da74c7c2f3eb75653c730e98fef8f7e1dcc0ab7ea1c9b17cae6375f
SSDEEP:	24576:OiGYw/6K/bd1YYJaOZpwxWs+RmATcoPoVLmudtnhNxeytXP7JLxtC:OiGJ/BRVTvPo5nhTeytXP7JltC
TLSH:	E1654A532190ABCFF7C6FAB385049B25D02EC17A4FB24A05541ED9F70B572824B2F9B6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...B..g.r........&....*.".....................@..........................................`... ............................

File Icon


Icon Hash:	13e0febefebefe1f

Static PE Info

General

Entrypoint:	0x1400013f0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x671E9742 [Sun Oct 27 19:40:50 2024 UTC]
TLS Callbacks:	0x40001cf0, 0x1, 0x40001cc0, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	8d5e528fe23b294949f51a142a33e57a

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	05/11/2020 01:00:00 03/01/2024 00:59:59
Subject Chain	CN=FACE IT LIMITED, O=FACE IT LIMITED, L=London, C=GB, SERIALNUMBER=07751649, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=GB
Version:	3
Thumbprint MD5:	4BDA8AC7265D4CC636DB09504D4CCBD2
Thumbprint SHA-1:	144662779D191ADF615F31BDFE4D28A318FE7D23
Thumbprint SHA-256:	EBBB1FD04EC6FF5381C8199CED28832FB1AC0DAD216740BD57650CC143069421
Serial:	0E09CEC5B700EEC8A2F9A38AB1C0290F

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [001440C5h]
mov dword ptr [eax], 00000000h
call 00007F134D18D5EFh
nop
nop
dec eax
add esp, 28h
ret
nop dword ptr [eax]
dec eax
sub esp, 28h
call 00007F134D18F29Ch
dec eax
cmp eax, 01h
sbb eax, eax
dec eax
add esp, 28h
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F134D18D849h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
dec eax
sub esp, 00000140h
dec eax
lea ebp, dword ptr [esp+00000080h]
dec eax
lea eax, dword ptr [ebp+000000B0h]
dec eax
mov ecx, eax
dec eax
mov eax, dword ptr [00147EDFh]
call eax
dec eax
lea eax, dword ptr [ebp-60h]
dec eax
mov edx, eax
mov ecx, 00000104h
dec eax
mov eax, dword ptr [00147EB2h]
call eax
dec eax
lea eax, dword ptr [ebp-60h]
dec eax
mov edx, eax
dec eax
lea eax, dword ptr [00143B6Ah]
dec eax
mov ecx, eax
call 00007F134D18F097h
nop
dec eax
add esp, 00000140h
pop ebp
ret
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
mov dword ptr [ebp-04h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x149000	0xbe8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x155000	0x160e2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x146000	0x2b8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x165e19	0x2b88	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14c000	0x98	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1450e0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x149318	0x250	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x21c8	0x2200	9a15d541f8a29a7013f4be7c9378b0da	False	0.5556066176470589	data	6.0343025856719565	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4000	0x140910	0x140a00	a8eb2956995d9e2c196aaf44b5e0f492	False	0.4205949987816764	data	6.5338836257153385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x145000	0x630	0x800	509ea949561cd578a69086fd5be04cde	False	0.3603515625	data	3.879711696126022	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x146000	0x2b8	0x400	a18a32296ae0ac35bbe1b2332e82a658	False	0.37890625	data	3.166345679357847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x147000	0x22c	0x400	92f2165392236f6408c6aa568a009ce9	False	0.24609375	data	2.567155203291899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x148000	0x1e0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x149000	0xbe8	0xc00	7201bd5ea529c9f298288948cbfea4b5	False	0.3450520833333333	data	4.380016457827972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x14a000	0x60	0x200	2b06c3fb9896340b270121b6fb0a085a	False	0.068359375	data	0.28655982431271465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x14b000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x14c000	0x98	0x200	53bbedb4fe54c3092137a3a5527b22f4	False	0.283203125	data	1.834442062760243	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/4	0x14d000	0x50	0x200	b8fdf6e552e12943a19e71d923b323d1	False	0.07421875	data	0.23263253450968063	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x14e000	0x1064	0x1200	0010f33700a0f6715c7a9044a8f86c80	False	0.3580729166666667	Matlab v4 mat-file (little endian) @\001, rows 134283269, columns 0, imaginary	5.085886369939772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/31	0x150000	0xaf	0x200	3926a4e9348a2d2f293d468143da249a	False	0.296875	data	2.128627013155538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/45	0x151000	0xa4	0x200	96c5ed06d2bbfee000ef06e1c40d1fc6	False	0.220703125	data	1.4891978798794558	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/57	0x152000	0x48	0x200	b67521fbbc06b691ae225d3bdb6755ca	False	0.12109375	data	0.7030875244532455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/70	0x153000	0xa3	0x200	e2f3c94b96d9bf5be041b4676e20bef4	False	0.275390625	data	2.467236418005127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/81	0x154000	0x1f8	0x200	cea13e6936ae59f922eee6b03f71b1da	False	0.330078125	data	4.838226073891876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x155000	0x160e2	0x16200	1cff358c657ed905a48a9d051c8bb181	False	0.15623896539548024	data	5.556068765886106	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x155144	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3779 x 3779 px/m	English	United States	0.6365248226950354
RT_ICON	0x1555ac	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m	English	United States	0.425422138836773
RT_ICON	0x156654	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 3779 x 3779 px/m	English	United States	0.23045583372697212
RT_ICON	0x15a87c	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/m	English	United States	0.12402401514255294
RT_GROUP_ICON	0x16b0a4	0x3e	data	English	United States	0.7741935483870968

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CreateProcessA, DeleteCriticalSection, EnterCriticalSection, GetCurrentDirectoryA, GetLastError, GetModuleFileNameA, GetSystemTime, GetThreadContext, InitializeCriticalSection, LeaveCriticalSection, ReadProcessMemory, ResumeThread, SetThreadContext, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualAllocEx, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WriteProcessMemory
api-ms-win-crt-environment-l1-1-0.dll	__p__environ, __p__wenviron
api-ms-win-crt-heap-l1-1-0.dll	_set_new_mode, calloc, free, malloc
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-private-l1-1-0.dll	__C_specific_handler, memcpy
api-ms-win-crt-runtime-l1-1-0.dll	__p___argc, __p___argv, __p___wargv, _beginthreadex, _cexit, _configure_narrow_argv, _configure_wide_argv, _crt_at_quick_exit, _crt_atexit, _endthreadex, _exit, _initialize_narrow_environment, _initialize_wide_environment, _initterm, _set_app_type, _set_invalid_parameter_handler, abort, exit, signal
api-ms-win-crt-stdio-l1-1-0.dll	__acrt_iob_func, __p__commode, __p__fmode, __stdio_common_vfprintf, __stdio_common_vfwprintf, fflush, fwrite, puts
api-ms-win-crt-string-l1-1-0.dll	memset, strlen, strncmp
api-ms-win-crt-time-l1-1-0.dll	__daylight, __timezone, __tzname, _tzset

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T01:34:15.307850+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.6	49710	176.124.204.206	15666	TCP
2024-10-28T01:34:15.307850+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.6	49710	176.124.204.206	15666	TCP
2024-10-28T01:34:15.307850+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.6	49710	176.124.204.206	15666	TCP
2024-10-28T01:34:15.313555+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.6	49710	176.124.204.206	15666	TCP
2024-10-28T01:34:15.313555+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.6	49710	176.124.204.206	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 01:34:08.961843014 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:08.967894077 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:08.967989922 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:09.609169960 CET	49712	443	192.168.2.6	172.67.74.152
Oct 28, 2024 01:34:09.609200954 CET	443	49712	172.67.74.152	192.168.2.6
Oct 28, 2024 01:34:09.609286070 CET	49712	443	192.168.2.6	172.67.74.152
Oct 28, 2024 01:34:09.617404938 CET	49712	443	192.168.2.6	172.67.74.152
Oct 28, 2024 01:34:09.617415905 CET	443	49712	172.67.74.152	192.168.2.6
Oct 28, 2024 01:34:10.238538027 CET	443	49712	172.67.74.152	192.168.2.6
Oct 28, 2024 01:34:10.238615036 CET	49712	443	192.168.2.6	172.67.74.152
Oct 28, 2024 01:34:10.427647114 CET	49712	443	192.168.2.6	172.67.74.152
Oct 28, 2024 01:34:10.427705050 CET	443	49712	172.67.74.152	192.168.2.6
Oct 28, 2024 01:34:10.427964926 CET	443	49712	172.67.74.152	192.168.2.6
Oct 28, 2024 01:34:10.429984093 CET	49712	443	192.168.2.6	172.67.74.152
Oct 28, 2024 01:34:10.442240953 CET	49712	443	192.168.2.6	172.67.74.152
Oct 28, 2024 01:34:10.487329960 CET	443	49712	172.67.74.152	192.168.2.6
Oct 28, 2024 01:34:10.619669914 CET	443	49712	172.67.74.152	192.168.2.6
Oct 28, 2024 01:34:10.619735003 CET	443	49712	172.67.74.152	192.168.2.6
Oct 28, 2024 01:34:10.619821072 CET	49712	443	192.168.2.6	172.67.74.152
Oct 28, 2024 01:34:10.640732050 CET	49712	443	192.168.2.6	172.67.74.152
Oct 28, 2024 01:34:10.640770912 CET	443	49712	172.67.74.152	192.168.2.6
Oct 28, 2024 01:34:15.307849884 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.313328028 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.313350916 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.313395023 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.313446045 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.313534975 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.313555002 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.313617945 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.313683987 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.313693047 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.313700914 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.313718081 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.313728094 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.313754082 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.313808918 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.318927050 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.318936110 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.318977118 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.318986893 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.319017887 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.319067955 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.319251060 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.319329023 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.319487095 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.319534063 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.319544077 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.319595098 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.319696903 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.319796085 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.319824934 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.319905996 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.324489117 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.324563026 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.324596882 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.324640989 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.324700117 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.324894905 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.324970007 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.325066090 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325112104 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325119972 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325128078 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.325197935 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.325309038 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325318098 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325376034 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.325403929 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325431108 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325439930 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325453997 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325458050 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.325464010 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325480938 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325489998 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325495958 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.325505972 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325515985 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325542927 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325562000 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325570107 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.325577021 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325587988 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325597048 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325606108 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.325609922 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.325639009 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.325692892 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.329919100 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.329937935 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.329946995 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.329994917 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330022097 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330028057 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330091000 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330092907 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330147982 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330203056 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330212116 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330219030 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330228090 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330248117 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330256939 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330280066 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330327988 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330332041 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330342054 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330349922 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330400944 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330408096 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330419064 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330425978 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330442905 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330451965 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330483913 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330499887 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330513000 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330547094 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330564022 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330626011 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330653906 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330662966 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330713034 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330727100 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330735922 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330744028 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330754042 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330780029 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330804110 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330833912 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330847979 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330862999 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330867052 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.330890894 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330919981 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.330981016 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331039906 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331048012 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331051111 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331113100 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331111908 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331156969 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331166029 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331176996 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331192017 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331209898 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331228971 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331262112 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331269026 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331279039 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331283092 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331286907 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331301928 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331310987 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331337929 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331347942 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331357956 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331398964 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331403017 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331413031 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331429005 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331437111 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331465006 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331469059 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331478119 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331504107 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331505060 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331515074 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331537008 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331546068 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331554890 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331572056 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331585884 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331602097 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331609011 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331629038 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331640005 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331646919 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331671000 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331686974 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331688881 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331701040 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331711054 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331726074 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331739902 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331748962 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331768990 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331809998 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.331824064 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.331877947 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.335335016 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335385084 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335392952 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.335395098 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335412025 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335449934 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.335479975 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335488081 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335514069 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335515022 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.335522890 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335532904 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335544109 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335553885 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.335612059 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.335649014 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335659027 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335679054 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335688114 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335702896 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335711956 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335716963 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.335745096 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.335773945 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335781097 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.335782051 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335823059 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335832119 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335839987 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335859060 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.335906982 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.335911036 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335921049 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335937977 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335946083 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335952997 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335972071 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335975885 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.335979939 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.335994959 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336013079 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336021900 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336026907 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336064100 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336071014 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336072922 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336095095 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336105108 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336126089 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336154938 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336155891 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336163998 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336178064 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336199045 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336211920 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336222887 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336252928 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336258888 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336272955 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336280107 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336292028 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336302042 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336319923 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336352110 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336352110 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336361885 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336379051 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336386919 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336405039 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336416006 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336420059 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336426020 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336442947 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336451054 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336453915 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336472034 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336491108 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336502075 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336504936 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336530924 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336535931 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336539984 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336550951 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336556911 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336566925 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336575031 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336581945 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336589098 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336592913 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336620092 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336623907 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336633921 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336651087 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336673021 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336682081 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336684942 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336710930 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336719990 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336741924 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336752892 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336764097 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336776018 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336790085 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336826086 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336836100 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336838007 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336846113 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336854935 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336870909 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336872101 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336884022 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336906910 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336911917 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336916924 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336931944 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336946011 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336958885 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336966038 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.336971045 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.336996078 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337003946 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337019920 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337035894 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337037086 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337047100 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337049007 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337055922 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337088108 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337096930 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337114096 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337121964 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337130070 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337173939 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337187052 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337197065 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337204933 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337224960 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337234020 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337240934 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337256908 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337281942 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337286949 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337291956 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337306976 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337316990 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337352991 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337369919 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337395906 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337446928 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337471962 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337481022 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337487936 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337518930 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337537050 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337548971 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337558985 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337565899 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337574005 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337589979 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337599039 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337613106 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337615013 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337624073 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337636948 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337672949 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337703943 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337713003 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337719917 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337738991 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337747097 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337768078 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337774992 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337776899 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337794065 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337814093 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337824106 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337826014 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337876081 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.337934017 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337943077 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337950945 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337959051 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337968111 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337981939 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.337990999 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.338001966 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.338002920 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.338011980 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.338022947 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.338028908 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.338035107 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.338038921 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.338047981 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.338057041 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.338063955 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.338066101 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.338116884 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.338126898 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.338135958 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.338144064 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.338151932 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.338186979 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.340787888 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.340862036 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.340910912 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.340961933 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341121912 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341130018 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341146946 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341156006 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341186047 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341197014 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341207027 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341221094 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341238976 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341252089 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341268063 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341269970 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341279030 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341299057 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341324091 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341326952 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341334105 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341351032 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341360092 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341376066 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341397047 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341404915 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341406107 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341440916 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341449976 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341451883 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341495991 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341499090 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341542959 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341552019 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341552019 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341593027 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341599941 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341609955 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341624022 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341634035 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341651917 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341659069 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341660976 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341682911 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341684103 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341715097 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341717958 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341722965 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341742992 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341759920 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341774940 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341800928 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341809034 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341856956 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341908932 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341919899 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341927052 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341934919 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341943979 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341953039 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341963053 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341970921 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341973066 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.341979980 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.341990948 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342046976 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342056990 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342060089 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342062950 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342071056 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342081070 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342091084 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342099905 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342108965 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342118025 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342118979 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342139006 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342163086 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342176914 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342178106 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342187881 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342195988 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342205048 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342216969 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342226028 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342233896 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342235088 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342242956 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342252016 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342272043 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342303991 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342309952 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342313051 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342320919 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342329979 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342339039 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342354059 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342360020 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342363119 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342371941 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342379093 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342381001 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342397928 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342406988 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342416048 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342432022 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342434883 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342468023 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342477083 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342478037 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342525005 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342572927 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342581987 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342590094 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342597961 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342617989 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342627048 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342629910 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342633009 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342650890 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342659950 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342668056 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342677116 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342690945 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342694044 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342700005 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342715025 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342716932 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342725992 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342746973 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342756033 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342761993 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342784882 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342787027 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342796087 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342801094 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342845917 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342847109 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342855930 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342900991 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342901945 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342920065 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342927933 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.342947960 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.342974901 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343046904 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343056917 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343065023 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343067884 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343077898 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343086958 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343096018 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343108892 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343111992 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343121052 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343130112 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343132019 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343138933 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343148947 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343156099 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343164921 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343172073 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343180895 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343189955 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343197107 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343206882 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343211889 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343216896 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343234062 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343261957 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343262911 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343272924 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343281031 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343281984 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343322992 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343324900 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343337059 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343383074 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343396902 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343413115 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343420982 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343436003 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343446016 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343461990 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343480110 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.343480110 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.343533039 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.386648893 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.386946917 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.387101889 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.387202024 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.387336016 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.387453079 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.387605906 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.387707949 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.387842894 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.387942076 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.388062954 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.388150930 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.388284922 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.388339043 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.432754993 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.433037043 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.433233023 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.433340073 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.433470011 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.433512926 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.438765049 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.439007998 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.439088106 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.439136982 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.449767113 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.450031996 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.450108051 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.450171947 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.450244904 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.450301886 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.450380087 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.450438023 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.450504065 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.450565100 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.450649977 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.450707912 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.450768948 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.450813055 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.455503941 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.455569029 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.502608061 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.502966881 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.503237009 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.503381968 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.503554106 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.503699064 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.503849030 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.503979921 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.504122019 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.504200935 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.554594040 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.554677010 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.589015007 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.589375973 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.589617014 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.589750051 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.589890003 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.594927073 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.595160007 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.638596058 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.638834000 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.685555935 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.685980082 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.686233044 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.686353922 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.691528082 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.691750050 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.691916943 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.692006111 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.738673925 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.738760948 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.771393061 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.771610022 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.771671057 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.771922112 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.772063971 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.772205114 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.772317886 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.772502899 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.772608995 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.772785902 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.772820950 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.777321100 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.777533054 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.777721882 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.777811050 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.818548918 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.818743944 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.853789091 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.854693890 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.854747057 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.854891062 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.854945898 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.855011940 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.855082035 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.855149984 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.855206966 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.855281115 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.855346918 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.855413914 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.855469942 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.855542898 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.855603933 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.855690956 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.855726004 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.860426903 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.860435963 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.860496998 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.860507965 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.860517025 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.860546112 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.860559940 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.860572100 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.860591888 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.860611916 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.860681057 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.860728025 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.906785965 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.907108068 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.907545090 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.907712936 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.907846928 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.907995939 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.908111095 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.908282995 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.908390999 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.908536911 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.908654928 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.908812046 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.908899069 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.935317039 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.935480118 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.935679913 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.935810089 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.935908079 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.936022043 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.936170101 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.936275005 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.936407089 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.936517000 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.936650038 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.936754942 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.936918974 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.937031984 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.937166929 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.937269926 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.937411070 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.937515974 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.941248894 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.941355944 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.982604980 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:15.983309984 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.983395100 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.983477116 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.983557940 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.983619928 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.983720064 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.983789921 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.983942032 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.984050989 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.984193087 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:15.984282017 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:16.005884886 CET	15666	49710	176.124.204.206	192.168.2.6
Oct 28, 2024 01:34:16.006398916 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:16.006623030 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:16.006747007 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:16.006877899 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:16.006988049 CET	49710	15666	192.168.2.6	176.124.204.206
Oct 28, 2024 01:34:16.007148981 CET	49710	15666	192.168.2.6	176.124.204.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 01:34:09.596888065 CET	192.168.2.6	1.1.1.1	0xbd7b	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 01:34:09.604763031 CET	1.1.1.1	192.168.2.6	0xbd7b	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 28, 2024 01:34:09.604763031 CET	1.1.1.1	192.168.2.6	0xbd7b	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 28, 2024 01:34:09.604763031 CET	1.1.1.1	192.168.2.6	0xbd7b	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49712	172.67.74.152	443	3548	C:\Windows\System32\attrib.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 00:34:10 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-10-28 00:34:10 UTC	211	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 00:34:10 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8d96d6afaf432ccc-DFW
2024-10-28 00:34:10 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 39 30 Data Ascii: 173.254.250.90

Target ID:	0
Start time:	20:34:07
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff684ca0000
File size:	1'477'025 bytes
MD5 hash:	EAB6FFE7B3ED8B11859E3C2858CB1B48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:34:07
Start date:	27/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:34:07
Start date:	27/10/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\attrib.exe"
Imagebase:	0x7ff698d90000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000002.00000002.2249385777.000001CBC4B34000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.1%
Total number of Nodes:	205
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF684CA1719 Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 213
injectionthreadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF684CA1801
memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF684CA181B
CreateProcessA.KERNELBASE ref: 00007FF684CA1879
ReadProcessMemory.KERNELBASE ref: 00007FF684CA18EA
VirtualAllocEx.KERNELBASE ref: 00007FF684CA1928
puts.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1945
WriteProcessMemory.KERNELBASE ref: 00007FF684CA198F
WriteProcessMemory.KERNELBASE ref: 00007FF684CA1A79
WriteProcessMemory.KERNELBASE ref: 00007FF684CA1ADB
SetThreadContext.KERNELBASE ref: 00007FF684CA1B12
ResumeThread.KERNELBASE ref: 00007FF684CA1B25

Strings

@, xrefs: 00007FF684CA190D
C:\Windo, xrefs: 00007FF684CA1759
ws\Syste, xrefs: 00007FF684CA1766
rib.exe, xrefs: 00007FF684CA1782
Failed to allocate memory in target process., xrefs: 00007FF684CA193B
m32\attr, xrefs: 00007FF684CA1774

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: Process$Memory$Write$Threadmemset$AllocContextCreateReadResumeVirtualputs
String ID: @$C:\Windo$Failed to allocate memory in target process.$m32\attr$rib.exe$ws\Syste
API String ID: 3837342824-4134978987
Opcode ID: 6b13a2d30c604ff2a75875a541f4c6d5bdaedd85531fe8d0f01bc11be9bba01e
Instruction ID: dc48a91a2ce39d25f5d15389a0533f0f3c067bcd7287e5fdbc1d77565f972e50
Opcode Fuzzy Hash: 6b13a2d30c604ff2a75875a541f4c6d5bdaedd85531fe8d0f01bc11be9bba01e
Instruction Fuzzy Hash: 13A1DCA1705BC58EDB70CF6AEC803D967A6FB88B88F404129DA4D8B768DF39D655C700

Function 00007FF684CA1180 Relevance: 12.1, APIs: 8, Instructions: 146
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF684CA1406), ref: 00007FF684CA11BE
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF684CA122F
_set_invalid_parameter_handler.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FF684CA1406), ref: 00007FF684CA1246
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF684CA1406), ref: 00007FF684CA1263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FF684CA1406), ref: 00007FF684CA1285
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF684CA1406), ref: 00007FF684CA1291
memcpy.API-MS-WIN-CRT-PRIVATE-L1-1-0(?,?,?,00007FF684CA1406), ref: 00007FF684CA12A9

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_set_invalid_parameter_handlermemcpystrlen
String ID:
API String ID: 959198572-0
Opcode ID: f6f20db29f42290ec6c3de1d4a693979f80b75b35e8db5484bb86adadd7a7be7
Instruction ID: 611102986b34cdf9d5483297c031af1b10c38dda023f55c27a728059c532dbf1
Opcode Fuzzy Hash: f6f20db29f42290ec6c3de1d4a693979f80b75b35e8db5484bb86adadd7a7be7
Instruction Fuzzy Hash: DF5155B5E09602C5FB10DF55E8D4279A3A9BF44B84F84423ADA0EE77A6DE3CE841C310

Function 00007FF684CA1B3C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

puts.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1B8B

Part of subcall function 00007FF684CA1719: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF684CA1801
Part of subcall function 00007FF684CA1719: memset.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF684CA181B
Part of subcall function 00007FF684CA1719: CreateProcessA.KERNELBASE ref: 00007FF684CA1879
Part of subcall function 00007FF684CA1719: ReadProcessMemory.KERNELBASE ref: 00007FF684CA18EA
Part of subcall function 00007FF684CA1719: VirtualAllocEx.KERNELBASE ref: 00007FF684CA1928
Part of subcall function 00007FF684CA1719: puts.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1945

puts.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1BB2
puts.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1BC8

Strings

File cant start now, xrefs: 00007FF684CA1BBE
File downloaded.., xrefs: 00007FF684CA1B81
Failed to run PE file from memory., xrefs: 00007FF684CA1BA8
Downloading..., xrefs: 00007FF684CA1B55

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: puts$Processmemset$AllocCreateMemoryReadVirtual
String ID: Downloading...$Failed to run PE file from memory.$File cant start now$File downloaded..
API String ID: 2368940784-3479206737
Opcode ID: 5a57d78937d7cde8d3da05b5e27fb2b2cb7c4d1b214c975ac5f71d01647b601c
Instruction ID: 575c4d0c0008d6d7e59054009745e82153dd99cc6c9eef14fa5e06ad38b001e0
Opcode Fuzzy Hash: 5a57d78937d7cde8d3da05b5e27fb2b2cb7c4d1b214c975ac5f71d01647b601c
Instruction Fuzzy Hash: 09014C94F08653D8FB10E7A5E8D92B853AC7F46784F80017AEC1EA73A2EE2CE105C340

Function 00007FF684CA15A0 Relevance: 1.4, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE ref: 00007FF684CA1702

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7b56c6e6f56ce49d9415a3c1db3b2ace441a652c6befc43e3e3f49e393c0a40f
Instruction ID: a0f31f405900893abbd2669cab334426afa144e242520c6ebc70a72d47485c3f
Opcode Fuzzy Hash: 7b56c6e6f56ce49d9415a3c1db3b2ace441a652c6befc43e3e3f49e393c0a40f
Instruction Fuzzy Hash: 004107B2B41745CEEB10CBA8D9853AC33B1FB55798F148569DA1C97B98DE3CEA05C700

Non-executed Functions

Function 00007FF684D2DEE0 Relevance: 16.3, APIs: 5, Strings: 4, Instructions: 567
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF684D2E090
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF684D2E09E
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF684D2E32D
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF684D2E33B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684D2E734

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684D2DEFD
operator, xrefs: 00007FF684D2E081, 00007FF684D2E31E, 00007FF684D2E557
2@@5@AEBUOptions@23@@Z@, xrefs: 00007FF684D2E55A
ed to \u0013, xrefs: 00007FF684D2DFB6, 00007FF684D2E25D

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_exception_destroy$Concurrency::cancel_current_task
String ID: 2@@5@AEBUOptions@23@@Z@$d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$ed to \u0013$operator
API String ID: 3534942345-3176673085
Opcode ID: d5a4b0d5de5765deedc4dc0bb1aaad938ac45959e4a9a5ea6747629422404892
Instruction ID: abb344d2d1978c8a1e762ec970f226e2d45cf3ae56d89be2fd3345f62232ccb5
Opcode Fuzzy Hash: d5a4b0d5de5765deedc4dc0bb1aaad938ac45959e4a9a5ea6747629422404892
Instruction Fuzzy Hash: 5B32B222A18B91C5EB00CB65D4843AD6761FF997A4F505339EA9E83BDADF7CE181C300

Function 00007FF684CDCF80 Relevance: 10.9, Strings: 6, Instructions: 3425COMMON

Download Yara Rule

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CDD027, 00007FF684CDE60A, 00007FF684CDF72A, 00007FF684CE0207
tectData, xrefs: 00007FF684CE0CC8
IJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF684CDD477, 00007FF684CDD763, 00007FF684CDDF88, 00007FF684CDF119, 00007FF684CDFCB4
@tyti@@U?$default_delete@U?$basic_object@D@vdf@tyti@@@std@@@std@@@2@@std@@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU, xrefs: 00007FF684CDE6AC, 00007FF684CDF87A
!, xrefs: 00007FF684CDDE4F
2@@5@AEBUOptions@23@@Z@, xrefs: 00007FF684CDE63C, 00007FF684CDF712, 00007FF684CDF91D, 00007FF684CE01F2

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: !$2@@5@AEBUOptions@23@@Z@$@tyti@@U?$default_delete@U?$basic_object@D@vdf@tyti@@@std@@@std@@@2@@std@@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU$IJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$tectData
API String ID: 3645842244-1855547753
Opcode ID: f347e8d440eb066e858b6cb672c321744e19cf924e68b836d93a657260a71437
Instruction ID: 8d16d5bde30e463e2a3a885a917e479a5b5b6430a5448bfbaff9cecd528c0b4a
Opcode Fuzzy Hash: f347e8d440eb066e858b6cb672c321744e19cf924e68b836d93a657260a71437
Instruction Fuzzy Hash: 29837372A15BC5C9EB208F24D8813ED7375FB89798F50522AEA9D47B99EF78D240C700

Function 00007FF684CF14F0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 399
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684CF15DD
__std_fs_code_page.LIBCPMT ref: 00007FF684CF1613
__std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF684CF166D
__std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF684CF16A5

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CF170B

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_fs_convert_narrow_to_wide$Concurrency::cancel_current_task__std_fs_code_page
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_
API String ID: 1751831074-1695713617
Opcode ID: 4cdb2fd2b0b13503603caa0a3616697b58e8b9c980583dade6c54ef63d510802
Instruction ID: aab4865edb968cd91099f2aa6af85e9b9000bae651c296e95dd64071f4cb42d9
Opcode Fuzzy Hash: 4cdb2fd2b0b13503603caa0a3616697b58e8b9c980583dade6c54ef63d510802
Instruction Fuzzy Hash: C8028D23A09B85CAE710CF65E8802AD73B4FB99798F14522AEF8D57B55DF78E580C700

Function 00007FF684CE9BE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF684CE9DBD

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CE9BF3, 00007FF684CE9FA6
operator, xrefs: 00007FF684CE9D80
must be followed by U+DC00..U+DFFF, xrefs: 00007FF684CE9D91
\u000D or \r, xrefs: 00007FF684CE9DCD

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_exception_copy
String ID: \u000D or \r$ must be followed by U+DC00..U+DFFF$d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$operator
API String ID: 592178966-446665495
Opcode ID: 7a3729de1739817ee9d3784d8d136fd0de6a941c688ceb7e32c29510488a2721
Instruction ID: afd09aff1276eb3cb6a84e27d127c022e5f7202ecf8244cf0e6edb434c5657c3
Opcode Fuzzy Hash: 7a3729de1739817ee9d3784d8d136fd0de6a941c688ceb7e32c29510488a2721
Instruction Fuzzy Hash: 68C1DF22E18B81C5EB008F64E4813AD7371FF99798F14933AEA9D56796EF38E195C340

Function 00007FF684D1DCF0 Relevance: 8.0, Strings: 6, Instructions: 501COMMON

Download Yara Rule

Strings

r U+0006 (ACK) must be escaped to \u0006, xrefs: 00007FF684D1DEC2, 00007FF684D1E0E1, 00007FF684D1E1DF, 00007FF684D1E3E7
d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684D1DD11, 00007FF684D1E52F
r U+0007 (BEL) must be escaped to \u0007, xrefs: 00007FF684D1E03C, 00007FF684D1E13A, 00007FF684D1E5BE
space, xrefs: 00007FF684D1E4D8
string: control character U+000E (SO) must be escaped to \u000E, xrefs: 00007FF684D1DE92, 00007FF684D1E0B1, 00007FF684D1E1AF, 00007FF684D1E3B7
2@@5@AEBUOptions@23@@Z@, xrefs: 00007FF684D1DD54

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID: 2@@5@AEBUOptions@23@@Z@$d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$r U+0006 (ACK) must be escaped to \u0006$r U+0007 (BEL) must be escaped to \u0007$space$string: control character U+000E (SO) must be escaped to \u000E
API String ID: 0-193913609
Opcode ID: 53c21970429f7daf5818a1ece0c8bae8f61cc70617ef1db9d298cdbf3b9ec0d1
Instruction ID: bfa152b03ce6dc9a943c564cd2f01656c8943d46cf0656ee7632cf62c4fcc217
Opcode Fuzzy Hash: 53c21970429f7daf5818a1ece0c8bae8f61cc70617ef1db9d298cdbf3b9ec0d1
Instruction Fuzzy Hash: C3420822619BC6C9EB20CF28D8803E977A5FB85748F44423ADA8E97B59EF78D545C700

Function 00007FF684CD5680 Relevance: 7.8, APIs: 1, Strings: 3, Instructions: 818COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684CD5770

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CD57A1
IJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF684CD5CF6
2@@5@AEBUOptions@23@@Z@, xrefs: 00007FF684CD5915

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: 2@@5@AEBUOptions@23@@Z@$IJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_
API String ID: 118556049-4236242035
Opcode ID: 83fea9e2c81b18a308780777de045eb8aa146a5ce6a0dbf9c0ddb9101cb86f1d
Instruction ID: 9486f2649f070ffbf2c6aad938fb8c6779f3b673abd8292b63c82a5ab780799e
Opcode Fuzzy Hash: 83fea9e2c81b18a308780777de045eb8aa146a5ce6a0dbf9c0ddb9101cb86f1d
Instruction Fuzzy Hash: EE828022A55BC2C5EB208F24D8C43ED6374FF85798F54523AEA4D87AA9EF38D645C300

Function 00007FF684D2D580 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF684D2D761

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684D2D594
operator, xrefs: 00007FF684D2D721
must be followed by U+DC00..U+DFFF, xrefs: 00007FF684D2D732

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_exception_copy
String ID: must be followed by U+DC00..U+DFFF$d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$operator
API String ID: 592178966-2576075652
Opcode ID: 119a2f519a5545c1ea094d679cf8a51b98fdf191924cdd5720f148be921897f6
Instruction ID: 4305a19d3276f8944097dca6f021ffb7e8aefbb3940712cf0e21732278912bd2
Opcode Fuzzy Hash: 119a2f519a5545c1ea094d679cf8a51b98fdf191924cdd5720f148be921897f6
Instruction Fuzzy Hash: DAB1D262F18B95C5EB008F68D4843AC6761FF59794F409336EA9E53B99DE7CE185C300

Function 00007FF684CF15F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 00007FF684CF1613
__std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF684CF166D
__std_fs_convert_narrow_to_wide.LIBCPMT ref: 00007FF684CF16A5

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CF170B

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_fs_convert_narrow_to_wide$__std_fs_code_page
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_
API String ID: 2896615418-1695713617
Opcode ID: 3db3add3d20bef612fcc3e6a23562098e1c16e4c6642733d13f207c488e2ff66
Instruction ID: d14d86825a8ed1e2c27a61a314337f305bf80dd60dca46d0fb549d14ad87df1f
Opcode Fuzzy Hash: 3db3add3d20bef612fcc3e6a23562098e1c16e4c6642733d13f207c488e2ff66
Instruction Fuzzy Hash: CCC13D23D18B858AE720CF25D8802AD77B4FB99788F11532AEF8D56A19DF78E5D0C740

Function 00007FF684D5EB6C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 278COMMON

Download Yara Rule

APIs

__std_fs_open_handle.LIBCPMT ref: 00007FF684D5ECE7
__std_fs_open_handle.LIBCPMT ref: 00007FF684D5EEF8

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684D5EB89

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_fs_open_handle
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_
API String ID: 2524151746-1695713617
Opcode ID: 73ff00a9e014d692192eb06c6066c2b665b51c5c2b49c4d59154dfc925a79ff2
Instruction ID: 53c40b15424a72b1c6f4a4899c9146297644dfc1d126567413cbf75ae99e6525
Opcode Fuzzy Hash: 73ff00a9e014d692192eb06c6066c2b665b51c5c2b49c4d59154dfc925a79ff2
Instruction Fuzzy Hash: D4B17132A1CA42C6E664AB25A88527962A0FF857B1F154739EA7FC77E4DF3CE441C700

Function 00007FF684CDB6B0 Relevance: 5.1, Strings: 3, Instructions: 1358COMMON

Download Yara Rule

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CDB6CF
2@@5@AEBUOptions@23@@Z@, xrefs: 00007FF684CDB8A1
unique_ptr@U?$basic_object@D@vdf@tyti@@U?$default_delete@U?$basic_object@D@vdf@tyti@@@std@@@std@@@2@@std@@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@, xrefs: 00007FF684CDB80A

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID: 2@@5@AEBUOptions@23@@Z@$d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$unique_ptr@U?$basic_object@D@vdf@tyti@@U?$default_delete@U?$basic_object@D@vdf@tyti@@@std@@@std@@@2@@std@@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@
API String ID: 0-827127618
Opcode ID: 3b0078f3a649b7a5e271a6012b32234cdb8d73e25fe9715d07f381bdba7f381c
Instruction ID: 520a18215728d87c1c635706c2cfaf57d9a5171806c54fc5accd1120510796c3
Opcode Fuzzy Hash: 3b0078f3a649b7a5e271a6012b32234cdb8d73e25fe9715d07f381bdba7f381c
Instruction Fuzzy Hash: 4BE27072A44BC5C9EB208F29D8843ED7374FB95798F505226DA9D97B99EF38D680C300

Function 00007FF684CE9620 Relevance: 2.8, Strings: 2, Instructions: 335COMMON

Download Yara Rule

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CE9637, 00007FF684CE988C
string: control character U+000B (VT) must be escaped to \u000B, xrefs: 00007FF684CE990F

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$string: control character U+000B (VT) must be escaped to \u000B
API String ID: 0-2279276501
Opcode ID: 283d29e132330dc9eb20c715f0a2c757d29a04da2ae3fbe3dfd3df475b9eb13a
Instruction ID: 373412b6114337b8e617ea8b7bd53bc526aae9a90a49b8c97e15a8ccb73f16c9
Opcode Fuzzy Hash: 283d29e132330dc9eb20c715f0a2c757d29a04da2ae3fbe3dfd3df475b9eb13a
Instruction Fuzzy Hash: C7E1A432A08B81C6EB60CFA5D4816AD73B9FF88758F01423AEA5D83B99DF78D550C740

Function 00007FF684CD4530 Relevance: 1.6, Strings: 1, Instructions: 336COMMON

Download Yara Rule

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CD454E

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_
API String ID: 0-1695713617
Opcode ID: 09c79e78e7eac65bfbecd450639a6e0a2e00504cc143ca4e4a9106a43d2f3207
Instruction ID: 93bcd8c0f2e50371dc6c44e69a7667af86fef86318b3cb1bcd8523b82dfbc561
Opcode Fuzzy Hash: 09c79e78e7eac65bfbecd450639a6e0a2e00504cc143ca4e4a9106a43d2f3207
Instruction Fuzzy Hash: 88F14032A19F8489EB608B69E88135D77B4FB88798F105329EADC57B99DF3CD190C704

Function 00007FF684CD4C20 Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CD4C3E

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_
API String ID: 0-1695713617
Opcode ID: 33338fc9515c92c9c8dc238a174b08de98dee56174606adb00d7226df25df173
Instruction ID: 12023d4fa02f0aa3fc15f1888a1d28c4122114811dc2b94b0018c8a77bcb87ce
Opcode Fuzzy Hash: 33338fc9515c92c9c8dc238a174b08de98dee56174606adb00d7226df25df173
Instruction Fuzzy Hash: CCF14032A19F8489EB208F69E48135DB7B4FB89798F105329EADD56B99EF3CD140C700

Function 00007FF684D3D9CC Relevance: 1.6, Strings: 1, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684D3D9E8

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: NameTranslate$_invalid_parameter_noinfo
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_
API String ID: 3581955945-1695713617
Opcode ID: 61b61c2f1d2d7afbc05897f1eb8e2cddf689bcd5cbc459122aa72d708066068b
Instruction ID: 071b59ade4c43d6fd1129bfc93cdfa14d3e9804a0ad1f10767648fae5e6bb123
Opcode Fuzzy Hash: 61b61c2f1d2d7afbc05897f1eb8e2cddf689bcd5cbc459122aa72d708066068b
Instruction Fuzzy Hash: 35C1A376A08782C5EB609B6195903BA67A1FF94BC8F404239DE8FC7695EF3CE545CB00

Function 00007FF684CA1450 Relevance: 1.3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

Strings

Dummy directory: %s, xrefs: 00007FF684CA148F

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Dummy directory: %s
API String ID: 2168557111-1626223530
Opcode ID: 101f958bf7e2c98b165bad5fb4c644748edf04a9083ea72838c00e36c604a177
Instruction ID: c33173f0c6657aafece233017a96b33ec867c0c3740e763805d388269c52e373
Opcode Fuzzy Hash: 101f958bf7e2c98b165bad5fb4c644748edf04a9083ea72838c00e36c604a177
Instruction Fuzzy Hash: D2E06D65B01B45D8EF11DB62E8C43E96325BF48784F84013ACE0D4B774EE2CD205C340

Function 00007FF684CD5250 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa62f7b6da8ad224eccdf6bfa4d18a7aba0ab3b01c02393cda3d7741aaad385
Instruction ID: aae6d5d7c63ece12c1f89aeac24bfd71815a76aabe0f4accc30147b0cd8bdf5b
Opcode Fuzzy Hash: 9aa62f7b6da8ad224eccdf6bfa4d18a7aba0ab3b01c02393cda3d7741aaad385
Instruction Fuzzy Hash: ADC15B32E06B85C9E701CF75D9C02A873B5FB59788F405229EE8DA6B55EF38E161C344

Function 00007FF684D61380 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8078a09573794ed6d7b5f4e0e67b6230490be0b03b580934ecd0f86303558dd3
Instruction ID: 73213d57bfb3b6432b1bb5161af7b3c71337e386ddb413e78105bed4a5e66d90
Opcode Fuzzy Hash: 8078a09573794ed6d7b5f4e0e67b6230490be0b03b580934ecd0f86303558dd3
Instruction Fuzzy Hash: 06816972A15A5286EB60CFA5D4853AD33A0FF84B98F04963AEF5F87695DF38D441C380

Function 00007FF684D1CFD0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b111e53581ed79373f170bff6f9a5d2c35bbbae99f8e587d860dc1a084ff43
Instruction ID: 05de4771621e33a0fa03275c785cfe5f4d5f047f3098d5fe539b333730cbd80d
Opcode Fuzzy Hash: 81b111e53581ed79373f170bff6f9a5d2c35bbbae99f8e587d860dc1a084ff43
Instruction Fuzzy Hash: B25106A3B0568443DB248B49FC42796F7A5FB987C5F00A12AEE8D57B58EB3CD581C700

Function 00007FF684DE9388 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e251b61a9e1cf7c92adaf2f054ca9dfb1ac3ff87b5859ba73cf30c8fd609c06
Instruction ID: 4f3cae3b2d3c91d6584fc4cb89592b7d275e9605670aea397b6c08379ac4e97b
Opcode Fuzzy Hash: 2e251b61a9e1cf7c92adaf2f054ca9dfb1ac3ff87b5859ba73cf30c8fd609c06
Instruction Fuzzy Hash: 71214A4B90F7C54AE7634AB44CF605C6FA1AE9291874E91EFC786C73D3D84D6849C322

Function 00007FF684CA3111 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdff31e18160255442d420fae1832a5a52ccebcf7d3d4df4aa26b73b5e00e239
Instruction ID: 613f0c3ead42f658f6f0bd6878269bfb381140e73e08bee3dd6b8e7a509c2eda
Opcode Fuzzy Hash: fdff31e18160255442d420fae1832a5a52ccebcf7d3d4df4aa26b73b5e00e239
Instruction Fuzzy Hash: 73A0021684ED01E0DB100B80E981AF0A578EB4B61DB442274C129A14B1CF6C90408105

Function 00007FF684D19A00 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684D19BB5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF684D19C4E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF684D19C97
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684D19E13

Part of subcall function 00007FF684D52420: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF684D52429

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684D19E26
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684D19E2C
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF684D19EAE
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF684D19EF6

Strings

eachable, xrefs: 00007FF684D19CB0, 00007FF684D19F0E
lower, xrefs: 00007FF684D19E19, 00007FF684D19FCB
function not supported, xrefs: 00007FF684D19CA6, 00007FF684D19F04
gpu, xrefs: 00007FF684D19D1E

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::_$Locinfo::_Locinfo_ctorLockitLockit::_$std::bad_alloc::bad_alloc
String ID: eachable$function not supported$gpu$lower
API String ID: 80508629-2289728929
Opcode ID: 9d8cee948c0abf1d34e6f977a0bf0e60582f5a80f8f0ee3451d197e5f2fd0f3a
Instruction ID: 8f12164ad8527a831d60739cbf2e53af1b65d5ce5b3006a2d27bb1c1d083cd03
Opcode Fuzzy Hash: 9d8cee948c0abf1d34e6f977a0bf0e60582f5a80f8f0ee3451d197e5f2fd0f3a
Instruction Fuzzy Hash: 8E026C32B09B41CAEB14DF61E4902AD63A5FF94B58F044639DE8E97A9ADF3CE411C344

Function 00007FF684CA1EA0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,00000000,00007FF684CA2071,?,?,?,?,?,?,00007FF684DE5628,00000000,?), ref: 00007FF684CA1EF0
VirtualQuery.KERNEL32 ref: 00007FF684CA1FBB

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF684CA204E
VirtualProtect failed with code 0x%x, xrefs: 00007FF684CA202E
Mingw-w64 runtime failure:, xrefs: 00007FF684CA1ED7
Address %p has no image-section, xrefs: 00007FF684CA1F12, 00007FF684CA2062

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: QueryVirtual__acrt_iob_func
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 4109086920-1534286854
Opcode ID: f09a80c1134d828c01efaecc68c9b68e5172b62628963cd11d42d28b0edd77e8
Instruction ID: d6108730c8a8c6d6b13e54f372c0c6c9c1001483d87f25c351d41333933cc3c4
Opcode Fuzzy Hash: f09a80c1134d828c01efaecc68c9b68e5172b62628963cd11d42d28b0edd77e8
Instruction Fuzzy Hash: 4451B4B2A08A56C5EB10CB51ECC06A9A7B5FF94B94F848239EE4D97795DF3CE441C300

Function 00007FF684D38414 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF684D38458
_invalid_parameter_noinfo.LIBCMT ref: 00007FF684D38830
_invalid_parameter_noinfo.LIBCMT ref: 00007FF684D38ADB

Strings

0, xrefs: 00007FF684D38880
p, xrefs: 00007FF684D38582
f, xrefs: 00007FF684D3857A
p, xrefs: 00007FF684D3850A

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: b17e1fa68d7c209e0f03e2520916445488a16dc0a91c82ce2b4168a76fe5ab7c
Instruction ID: 02be65f691b7147f68d601a78db28b0cf93de2dbf824f7de432a48166e727c7a
Opcode Fuzzy Hash: b17e1fa68d7c209e0f03e2520916445488a16dc0a91c82ce2b4168a76fe5ab7c
Instruction Fuzzy Hash: 75126E72A0C243C6FB245A15A4847B976E2FF90B94F848639F69B876C4EF3CE580C714

Function 00007FF684D41434 Relevance: 12.6, Strings: 10, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CHN, xrefs: 00007FF684D41577
ESG, xrefs: 00007FF684D4147F
ESD, xrefs: 00007FF684D41441
ESY, xrefs: 00007FF684D414EF, 00007FF684D41502
ESM, xrefs: 00007FF684D4149E
USA, xrefs: 00007FF684D41558
ESR, xrefs: 00007FF684D414DC
ESI, xrefs: 00007FF684D414B1, 00007FF684D414C4
ESE, xrefs: 00007FF684D41454, 00007FF684D41467
ENU, xrefs: 00007FF684D4150E, 00007FF684D41521

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID: CHN$ENU$ESD$ESE$ESG$ESI$ESM$ESR$ESY$USA
API String ID: 0-1681952876
Opcode ID: 59f4195e7b3ccf5729206a2966c8c635a87b82da9d0cdb6ec903e65abd0a3e52
Instruction ID: c03d15d9c8c44c00f935cb38ff9a364435ca0fd5f8291e89aaf64f99fbcc5c0d
Opcode Fuzzy Hash: 59f4195e7b3ccf5729206a2966c8c635a87b82da9d0cdb6ec903e65abd0a3e52
Instruction Fuzzy Hash: BF311BA0A1CA4BE1FA15DB94E8D16F42371BF44348FC0563FE50FA61A5DE7CA64AC381

Function 00007FF684CD2FB0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 278
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_fs_code_page.LIBCPMT ref: 00007FF684CD300F
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF684CD32A7

Strings

xdigit, xrefs: 00007FF684CD30B8
d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CD2FCE
operator, xrefs: 00007FF684CD3299, 00007FF684CD3353

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_exception_destroy__std_fs_code_page
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$operator$xdigit
API String ID: 4014462690-2575493076
Opcode ID: c084d0128df64970062c2312707118524547be05ed639d0701a8f320b51a76b8
Instruction ID: 59f011eed05cf07e032d6d42edcea492351283d108c64fbfaf59a8ed0424033e
Opcode Fuzzy Hash: c084d0128df64970062c2312707118524547be05ed639d0701a8f320b51a76b8
Instruction Fuzzy Hash: DDA1A862B08A81D5FB00DF25E4943AD2375FF48B88F50853ADA5D87BAADF79D486C340

Function 00007FF684CD1E30 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF684CD1E9E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF684CD1EE6
_Getctype.LIBCPMT ref: 00007FF684CD1F24

Strings

eachable, xrefs: 00007FF684CD1EFE
lower, xrefs: 00007FF684CD1FDD
function not supported, xrefs: 00007FF684CD1EF4

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: eachable$function not supported$lower
API String ID: 1612978173-2004401088
Opcode ID: 40c7454b4a1272e6f12cf915ad7bc6efeb3b83da4fd0ae39ec654a8b1f0dc425
Instruction ID: bd8107ba9714dc28b49547ba9fbb9dd4c32b3d78f6d33d9b564b50b348b90a4b
Opcode Fuzzy Hash: 40c7454b4a1272e6f12cf915ad7bc6efeb3b83da4fd0ae39ec654a8b1f0dc425
Instruction Fuzzy Hash: 83917C32B09B41CAEB15DB60D4903BD36A5FF94788F04423EEA4E97A9ADF38E555C340

Function 00007FF684D4B4AC Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

APIs

TranslateName.LIBCMT ref: 00007FF684D4B519
TranslateName.LIBCMT ref: 00007FF684D4B554

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684D4B727
ian-swiss, xrefs: 00007FF684D4B548
itain, xrefs: 00007FF684D4B512

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: NameTranslate
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$ian-swiss$itain
API String ID: 2039356047-1976367729
Opcode ID: aea9805d8be47ef358fece8431e17e8582b9befa990eef2d98ad3ed5edee7f72
Instruction ID: ab0fce00181e0e23f1b67463f7f7be81f8e585f84768a4528e85e3eb82580d03
Opcode Fuzzy Hash: aea9805d8be47ef358fece8431e17e8582b9befa990eef2d98ad3ed5edee7f72
Instruction Fuzzy Hash: B6914732A08782C6EB74AF6194812B963A4FF64BC4F444239DE5E8B786EF3CE551C700

Function 00007FF684CEA790 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 174COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF684CEA971

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CEA7A4
iostream stream error, xrefs: 00007FF684CEA800
operator, xrefs: 00007FF684CEA931
must be followed by U+DC00..U+DFFF, xrefs: 00007FF684CEA942

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_exception_copy
String ID: must be followed by U+DC00..U+DFFF$d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$iostream stream error$operator
API String ID: 592178966-856831111
Opcode ID: 173c248ad31fc580bfca202b648d0bd64c90a4d464a55cfaf713f72dd4015b9f
Instruction ID: d9c17f52b40e60b731ba4646a9c92cd7110469cb4fcaa3e7583ffacc0a36560d
Opcode Fuzzy Hash: 173c248ad31fc580bfca202b648d0bd64c90a4d464a55cfaf713f72dd4015b9f
Instruction Fuzzy Hash: 48718F62F18B81C9FB008F78D4813AC2361FF55798F419336EA5D56ADAEF789185C300

Function 00007FF684D4BEE0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

ProcessCodePage.LIBCMT ref: 00007FF684D4C07A

Strings

ed-states, xrefs: 00007FF684D4BF50
d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684D4BEF2
great britain, xrefs: 00007FF684D4BFA9
ian-swiss, xrefs: 00007FF684D4BFB8

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: CodePageProcess
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$ed-states$great britain$ian-swiss
API String ID: 2600045632-574136104
Opcode ID: 28463d91f7400e7509a22e1b42e99e6c2af4af39ef8f4877dc94fa25e213d4a5
Instruction ID: 4e1bf2f8f47842de514dfd1b389cde5481ac8bf9255007a2a4bc9e627f4443f7
Opcode Fuzzy Hash: 28463d91f7400e7509a22e1b42e99e6c2af4af39ef8f4877dc94fa25e213d4a5
Instruction Fuzzy Hash: ED715A32B08712CAFB219B65D8906B923B0BF58B84F45423ACE1E97695EF3DE446C750

Function 00007FF684CE7300 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF684CE732B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF684CE7350
std::_Facet_Register.LIBCPMT ref: 00007FF684CE73FB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684CE7446

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CE7312

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_
API String ID: 1168246061-1695713617
Opcode ID: 62054f4dadd8996ea77fc01b27df17d647a8fb42a4f7ee0450ac107cf0e9d070
Instruction ID: b291e5eee1677737325768085e8547f8bc53ecf2274921a1611c3cdfd006b9e9
Opcode Fuzzy Hash: 62054f4dadd8996ea77fc01b27df17d647a8fb42a4f7ee0450ac107cf0e9d070
Instruction Fuzzy Hash: 0F519F22A18B81C2EB149B25E4C136977A4FF94B94F19473ADA9D877A9DF3CE181C700

Function 00007FF684CA14A8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

puts.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA14FE
puts.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA150F
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1525

Strings

Balance done., xrefs: 00007FF684CA14F4
Balance here., xrefs: 00007FF684CA1505

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: puts$fflush
String ID: Balance done.$Balance here.
API String ID: 2647259923-1376018514
Opcode ID: 3af7f36b98e8c874185ba7101167ecb57fb444cb4fc568d4fe4cac4507a22402
Instruction ID: 9ee640f9dcfd260727a5a3aeff8d30884417cacea772c2eb84a07732cd9795e7
Opcode Fuzzy Hash: 3af7f36b98e8c874185ba7101167ecb57fb444cb4fc568d4fe4cac4507a22402
Instruction Fuzzy Hash: BE014872F18202DEFB10DBA5C8853B822B8BF00358F10017ADE1EEA3D5DE2CA680C600

Function 00007FF684D5F5B4 Relevance: 7.6, Strings: 6, Instructions: 63COMMON

Download Yara Rule

Strings

ogress, xrefs: 00007FF684D5F658
domain, xrefs: 00007FF684D5F660
pty, xrefs: 00007FF684D5F650
filename too long, xrefs: 00007FF684D5F640
in use, xrefs: 00007FF684D5F668
file exists, xrefs: 00007FF684D5F648

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID: domain$file exists$filename too long$in use$ogress$pty
API String ID: 0-2721743378
Opcode ID: 28a39fcff2112d3bf8a01e0ded423e318209f21e4f433f8615dfea5023a8cd0d
Instruction ID: f4e0dcd824347a2a6156d9b1bdbf6a726a0dfb9352c10c772a8cb6d0e4b6e00b
Opcode Fuzzy Hash: 28a39fcff2112d3bf8a01e0ded423e318209f21e4f433f8615dfea5023a8cd0d
Instruction Fuzzy Hash: FA211AB2E49647E4ED999F2C96F85B42A94FF95300B9B037EC51FC6678DD1EE604C200

Function 00007FF684CEEFD0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 339COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684CEF145
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684CEF2CC
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684CEF44C

Strings

2@@5@AEBUOptions@23@@Z@, xrefs: 00007FF684CEF16A, 00007FF684CEF2EA

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: 2@@5@AEBUOptions@23@@Z@
API String ID: 118556049-3621887160
Opcode ID: 50fa9f1bcb0824c46e1ebfb624846b5897aeedd9f4e87c363e3dae4c30f53f0c
Instruction ID: eb7c24f17bc28282fb835dcbe641f143bf42969b5261825381963fadae49194d
Opcode Fuzzy Hash: 50fa9f1bcb0824c46e1ebfb624846b5897aeedd9f4e87c363e3dae4c30f53f0c
Instruction Fuzzy Hash: FEB1D122B09AC691E914DB16E8811BA6368FF44BE4F544A3ADFAD87BD5DF3CE041C300

Function 00007FF684CA2080 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 227memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00007FF684DE80B0,00007FF684DE80B8,00000001,?,?,?,?,00007FFDB240ADA0,00007FF684CA1228,?,?,?,00007FF684CA1406), ref: 00007FF684CA227D

Strings

%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF684CA22E4
Unknown pseudo relocation protocol version %d., xrefs: 00007FF684CA23D2
Unknown pseudo relocation bit size %d., xrefs: 00007FF684CA23C6

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: b48a8d85edbdaec96c8b1b9b15a561edb0c35f366a9d529c8dc3dc3da2bef896
Instruction ID: 527bc7160be6f90e9ea928516208002972fb04037cf3f8bd5edabc09f2aa6fe4
Opcode Fuzzy Hash: b48a8d85edbdaec96c8b1b9b15a561edb0c35f366a9d529c8dc3dc3da2bef896
Instruction Fuzzy Hash: 2691A4B6E09562C5EA10DB60D8C4A7962B8BF51768F44873ADA2DA77D8DF3CE841C301

Function 00007FF684CD3DD0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CD3DE3
operator, xrefs: 00007FF684CD4052

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$operator
API String ID: 0-179660579
Opcode ID: bca8d15c6afb419b36759e8a63ce7f33a896df6a5da27ea7b731f6e5bfe9e7a6
Instruction ID: b73c837b760651377bfabeb14231b25ab792d7f90ac5033e5dd3e6830a25f31c
Opcode Fuzzy Hash: bca8d15c6afb419b36759e8a63ce7f33a896df6a5da27ea7b731f6e5bfe9e7a6
Instruction Fuzzy Hash: 4C71DB62F14B8185FB00CB69D4813AC2775FF95B94F54423AEE5E57A9ACF78D082C340

Function 00007FF684CFEA90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 00007FF684CFEC70
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF684CFEC7D

Strings

operator, xrefs: 00007FF684CFEC62
ust be escaped to \u0012, xrefs: 00007FF684CFEB48

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_exception_destroy
String ID: operator$ust be escaped to \u0012
API String ID: 2453523683-439290408
Opcode ID: cbd1433ec780505788d469b49c7c5536c4d6b0a270802974f308ee9315a85848
Instruction ID: d7708a7ac65e8cfd13fd6c9a41880ff7a26a474ffc63e85e718c0d6814184c46
Opcode Fuzzy Hash: cbd1433ec780505788d469b49c7c5536c4d6b0a270802974f308ee9315a85848
Instruction Fuzzy Hash: F1519E62A18741C1EB149F19E08026E6721FF85BD0F50423AEBAE43BD6DF7CE081C740

Function 00007FF684D481C8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 00007FF684D48225
__free_lconv_num.LIBCMT ref: 00007FF684D48247

Strings

?AV?$vector@V?$unique_ptr@U?$basic_object@D@vdf@tyti@@U?$default_delete@U?$basic_object@D@vdf@tyti@@@std@@@std@@V?$allocator@V?$unique_ptr@U?$basic_object@D@vdf@tyti@@U?$default_delete@U?$basic_object@D@vdf@tyti@@@std@@@std@@@2@@std@@V?$_String_const_iterator@, xrefs: 00007FF684D481EB
ator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@5@AEBUOptions@23@@Z@, xrefs: 00007FF684D482D3

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __free_lconv_mon__free_lconv_num
String ID: ?AV?$vector@V?$unique_ptr@U?$basic_object@D@vdf@tyti@@U?$default_delete@U?$basic_object@D@vdf@tyti@@@std@@@std@@V?$allocator@V?$unique_ptr@U?$basic_object@D@vdf@tyti@@U?$default_delete@U?$basic_object@D@vdf@tyti@@@std@@@std@@@2@@std@@V?$_String_const_iterator@$ator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@5@AEBUOptions@23@@Z@
API String ID: 2148069796-66340973
Opcode ID: 69e38d382c4f3b29a707a32239b9d597503d838726518d827f5f30b403d10bd7
Instruction ID: c2c386c7a9a87e308aa1d85bd6df3acfbd3d4010c68ed660b923376d1e8b5fa4
Opcode Fuzzy Hash: 69e38d382c4f3b29a707a32239b9d597503d838726518d827f5f30b403d10bd7
Instruction Fuzzy Hash: 5D41CB36A1AA42C5EE759F65C4D43BC2350BF85FC4F088639EA4F97695DE6CE481C310

Function 00007FF684CA2429 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

signal.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF684CA24A2

Strings

CCG , xrefs: 00007FF684CA2445

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: ab4e1c633ad4449b1a3e44c2f9961996aaf6eb8def0ead5230d4cc82aa084f27
Instruction ID: 0f28b3ac914af0a5106cff233d33603990beec7e95c641d29df569905996ba74
Opcode Fuzzy Hash: ab4e1c633ad4449b1a3e44c2f9961996aaf6eb8def0ead5230d4cc82aa084f27
Instruction Fuzzy Hash: 8121B0D1E0D922C2FA69D2A8D0E477811A9BF89354F19493FDA1DD63D1DF1CE8C1C211

Function 00007FF684CE57C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF684CE57EF
__std_exception_copy.LIBVCRUNTIME ref: 00007FF684CE581F

Strings

operator, xrefs: 00007FF684CE57D7
must be followed by U+DC00..U+DFFF, xrefs: 00007FF684CE57F5

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_exception_copy
String ID: must be followed by U+DC00..U+DFFF$operator
API String ID: 592178966-514014180
Opcode ID: 53ddb2118ee7bae31a66eedc50c7117b7d2163d0fe743ad4496814a738b24505
Instruction ID: b62eac053b6e07ac4bcf857070e8df3274ae8a72bdae8070a8d7afd022b907cb
Opcode Fuzzy Hash: 53ddb2118ee7bae31a66eedc50c7117b7d2163d0fe743ad4496814a738b24505
Instruction Fuzzy Hash: 24011372A04B44E6D7119F25E880099B364FB58794B98D236DB8D82B25EE38E5E5C300

Function 00007FF684D1F530 Relevance: 6.6, Strings: 5, Instructions: 350COMMON

Download Yara Rule

Strings

r U+0006 (ACK) must be escaped to \u0006, xrefs: 00007FF684D1F98F
d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684D1F542
string: control character U+000E (SO) must be escaped to \u000E, xrefs: 00007FF684D1F94D
2@@5@AEBUOptions@23@@Z@, xrefs: 00007FF684D1F650
@@2@@std@@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$ba, xrefs: 00007FF684D1FBE0

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_fs_convert_narrow_to_wide$__std_fs_code_page
String ID: 2@@5@AEBUOptions@23@@Z@$@@2@@std@@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$ba$d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$r U+0006 (ACK) must be escaped to \u0006$string: control character U+000E (SO) must be escaped to \u000E
API String ID: 2896615418-3726601797
Opcode ID: 5db88798ebcdff8890de2a7d89abf8b1082c11c5724509c71614d068e72ced82
Instruction ID: 7732fdab6e3d21c6c55954c82d5e478ef5c2f0afca2e87d2ef387b1c6b104714
Opcode Fuzzy Hash: 5db88798ebcdff8890de2a7d89abf8b1082c11c5724509c71614d068e72ced82
Instruction Fuzzy Hash: E2026472A19AC6C1EA21DB14E4D43EEA364FFC4744F40423ADA8E87AA9DF7CD545CB00

Function 00007FF684D3E3D4 Relevance: 6.5, Strings: 5, Instructions: 208COMMONLIBRARYCODE

Download Yara Rule

Strings

C, xrefs: 00007FF684D3E4E6
@U?$basic_object@D@vdf@tyti@@@std@@@std@@@2@@std@@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$, xrefs: 00007FF684D3E5DA
d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684D3E3F3
U, xrefs: 00007FF684D3E431
ator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@5@AEBUOptions@23@@Z@, xrefs: 00007FF684D3E6B8

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID: @U?$basic_object@D@vdf@tyti@@@std@@@std@@@2@@std@@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$$C$U$ator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@5@AEBUOptions@23@@Z@$d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_
API String ID: 0-2514502126
Opcode ID: 3d77e73bf58285045ad2f15e7036e3e453e6a56216d138070606037ee5f9d77e
Instruction ID: 6f6fadcd7c6de19f6cde5c05158a3727f7c5aa76e07715187495408efe0b2681
Opcode Fuzzy Hash: 3d77e73bf58285045ad2f15e7036e3e453e6a56216d138070606037ee5f9d77e
Instruction Fuzzy Hash: 7D91B032A19695D6EB65CB25E4847AD73A4FF88794F104339EA4E83B94EF3CE451CB00

Function 00007FF684D17510 Relevance: 6.3, Strings: 5, Instructions: 80COMMON

Download Yara Rule

Strings

string: control character U+0000 (NUL) must be escaped to \u0000, xrefs: 00007FF684D17629
ash, xrefs: 00007FF684D175DF
st be escaped to \u000D or \r, xrefs: 00007FF684D1752A
string: surrogate U+DC00..U+DFFF must follow U+D800..U+DBFF, xrefs: 00007FF684D17534
string: control character U+0006 (ACK) must be escaped to \u0006, xrefs: 00007FF684D175FF

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID: ash$st be escaped to \u000D or \r$string: control character U+0000 (NUL) must be escaped to \u0000$string: control character U+0006 (ACK) must be escaped to \u0006$string: surrogate U+DC00..U+DFFF must follow U+D800..U+DBFF
API String ID: 0-1371089726
Opcode ID: 97c9c9fb4913ab7e4e9b2d164bff744e7f0033a1d4d32db8e403dec60fffa933
Instruction ID: 02db463a43a4619fa00dfbbe9f687c10b838ecb239b33a14ce1d6c9a253f6603
Opcode Fuzzy Hash: 97c9c9fb4913ab7e4e9b2d164bff744e7f0033a1d4d32db8e403dec60fffa933
Instruction Fuzzy Hash: 3941E732605F85CADB10CF19E5C0169BBB4FB88B49B55C62ACB8E83720DF7AE156C740

Function 00007FF684CFDBF0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 325COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684CFE030

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CFDDBE
2@@5@AEBUOptions@23@@Z@, xrefs: 00007FF684CFDC02

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: 2@@5@AEBUOptions@23@@Z@$d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_
API String ID: 118556049-2549595569
Opcode ID: 25b7050dd8e14b3b31ed8be001b74f2e61024810812873b7e49af35c9c963afb
Instruction ID: 615cf4de01c6f18e95e1e989d8eba58bf24ca4544cf0a0c7c23afcf9deeb53fa
Opcode Fuzzy Hash: 25b7050dd8e14b3b31ed8be001b74f2e61024810812873b7e49af35c9c963afb
Instruction Fuzzy Hash: C2C1AF32A09B81C2EB108F15E480369B7B5FB85B94F19813AEB8E47B95DFBCD481C700

Function 00007FF684D47998 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF684D47A69

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684D47AC1, 00007FF684D47B65
h-english, xrefs: 00007FF684D47A39

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$h-english
API String ID: 3215553584-3928706287
Opcode ID: 159020f3acb80e923889ac9b28097274fad83d1d42c20df0c096c6933b052621
Instruction ID: 154625bdd30c191694f40c9d5860db6cea19f04afa0351f044c19ee08fb714f3
Opcode Fuzzy Hash: 159020f3acb80e923889ac9b28097274fad83d1d42c20df0c096c6933b052621
Instruction Fuzzy Hash: E5917732A09686C2FA759B25A4C127A66A0FF407C4F544A3DDA5F9B7E1EE3CE941C300

Function 00007FF684CDA2F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CDA432

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_
API String ID: 0-1695713617
Opcode ID: b342862ec76fd47dee61953702874e9f6299265352f1bc29f9ff8994afac1827
Instruction ID: 2b95cb028f5b2f5e27aabe44c2256786d65300f186c4b8b7cfa51c25d554408f
Opcode Fuzzy Hash: b342862ec76fd47dee61953702874e9f6299265352f1bc29f9ff8994afac1827
Instruction Fuzzy Hash: 9C618522A49B42CAEA249F11E48037962A9FF487E4F581739DEAD47BD5DF3DE491C300

Function 00007FF684CEC5B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF684CEC6C2

Strings

eachable, xrefs: 00007FF684CEC6F8
function not supported, xrefs: 00007FF684CEC702

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: eachable$function not supported
API String ID: 118556049-3534612884
Opcode ID: dc370f955ca59d4b33d95e21242b770027761bfbe08dbd7c31a929121c04067b
Instruction ID: 636c98bccf2294dede66fd8971787913dd9224ebb1881bf6d48105ce580acf07
Opcode Fuzzy Hash: dc370f955ca59d4b33d95e21242b770027761bfbe08dbd7c31a929121c04067b
Instruction Fuzzy Hash: 7C41C132B05B45D1EA149B12E9C52AA62A8FF48BE4F18473ADE6D877D5EF3CD491C300

Function 00007FF684CD3380 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF684CD340D

Strings

eral, xrefs: 00007FF684CD3439
operator, xrefs: 00007FF684CD33F5

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_exception_copy
String ID: eral$operator
API String ID: 592178966-3821090533
Opcode ID: ae0a8b09ca9451badf197f1976b0f57fa78388ca91d24fe9a769a44bd1b19fcc
Instruction ID: 1cf866b5ff36332ed0f441b11c426b08a1f934dc91a79bc7da827f39df434857
Opcode Fuzzy Hash: ae0a8b09ca9451badf197f1976b0f57fa78388ca91d24fe9a769a44bd1b19fcc
Instruction Fuzzy Hash: A4315E22909B86E1DB119F14E5801E97374FF94744F809236E78D4366AEF38E6A9C740

Function 00007FF684D51340 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

capture_previous_context.LIBCMT ref: 00007FF684D519EA

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684D51A64
std@@@std@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V, xrefs: 00007FF684D51A79

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: capture_previous_context
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$std@@@std@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V
API String ID: 913372019-629703798
Opcode ID: d2be7348ff9ce230cc743c672f79cae30b69e46daf806bb313cd1bdba00f6238
Instruction ID: 7d1432f3ef500cd584da7350ee88748c67560e8c98fb6f7c0a3c1c267f440c8e
Opcode Fuzzy Hash: d2be7348ff9ce230cc743c672f79cae30b69e46daf806bb313cd1bdba00f6238
Instruction Fuzzy Hash: BF21DB34A09B02C2FB409B18E8913B867A4FF95708F90123AD98EC37A5EF3DA444CB00

Function 00007FF684CA1D90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1DE8

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF684CA1E09
Unknown error, xrefs: 00007FF684CA1E7C

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __acrt_iob_func
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 711238415-3474627141
Opcode ID: f528937272dd32a8eaa8efad4902fb29401ad3a1864d1b0760f556769c8dda61
Instruction ID: 9c88a83a042433b53369a13dfe000336dd66d423a5df6ec5da536f6deb2e3b35
Opcode Fuzzy Hash: f528937272dd32a8eaa8efad4902fb29401ad3a1864d1b0760f556769c8dda61
Instruction Fuzzy Hash: AF0108A2C08E84C1D202CF1CD8811FAB374FF5978AF245326EB8C66220DF29D543C700

Function 00007FF684CD0DB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF684CD0DFD

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CD0DB6
operator, xrefs: 00007FF684CD0DDA

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_exception_copy
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$operator
API String ID: 592178966-179660579
Opcode ID: f8db7b87c0aa70b5c2c2406d22323eda49e74d07bb3df65c4619f77c50b753c1
Instruction ID: 4e5ebc6a374645e1c8732dfc2d9313077b440bb25fab40797f21a4883dfc39e1
Opcode Fuzzy Hash: f8db7b87c0aa70b5c2c2406d22323eda49e74d07bb3df65c4619f77c50b753c1
Instruction Fuzzy Hash: 8DF0A4B2A28B85C1EB008F15F4901A97764FF99784F54523AEA8E83761EF3CE1E1C700

Function 00007FF684CD0E30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00007FF684CD0E73

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CD0E36
operator, xrefs: 00007FF684CD0E50

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __std_exception_copy
String ID: d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$operator
API String ID: 592178966-179660579
Opcode ID: 1f1333c052e102018ce6c721f4d98f2d7bedc39e4f31c71514575dd0eeb4ceca
Instruction ID: 9517efde0db26ddfc3c9fb3b5360126a59f509d00ff00321ba3e662a46ac1ba1
Opcode Fuzzy Hash: 1f1333c052e102018ce6c721f4d98f2d7bedc39e4f31c71514575dd0eeb4ceca
Instruction Fuzzy Hash: A3F096B2A19B80C1EB419F20F8901A97764FF9D784F545336EA8E82725EF3CD195C700

Function 00007FF684CA1E30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1DE8

Part of subcall function 00007FF684CA2D10: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF684CA2EA3,?,?,00007FF684DE80B0,00007FF684CA1341), ref: 00007FF684CA2D38

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF684CA1E09
Argument domain error (DOMAIN), xrefs: 00007FF684CA1E30

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-2713391170
Opcode ID: ee3f3bb47bd6a24556798c34e3bc92ffd6b12cba5a125b18ea1b5722df76c2ba
Instruction ID: 404f454995469b1e0d428a48fba93fc1e12c923c150baad69ec18638630a21e5
Opcode Fuzzy Hash: ee3f3bb47bd6a24556798c34e3bc92ffd6b12cba5a125b18ea1b5722df76c2ba
Instruction Fuzzy Hash: 25F06252818E94C1D202DF18E8800EBB374FF4D789F24572AEE8D3A565DF28D643C700

Function 00007FF684CA1E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1DE8

Part of subcall function 00007FF684CA2D10: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF684CA2EA3,?,?,00007FF684DE80B0,00007FF684CA1341), ref: 00007FF684CA2D38

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF684CA1E09
Overflow range error (OVERFLOW), xrefs: 00007FF684CA1E50

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-4064033741
Opcode ID: f79fd0e596f964fb12d506a581b5651c7ef29de0136867c86ca042b8d340619f
Instruction ID: c2ef6f86fc65177207dc6efb3b04bd70e78a0ece167c46b94b5f7c7da5d76bdb
Opcode Fuzzy Hash: f79fd0e596f964fb12d506a581b5651c7ef29de0136867c86ca042b8d340619f
Instruction Fuzzy Hash: B8F06252818E94C1D202DF18E8800EBB374FF4D789F68572AEE8D3A565DF28D643C700

Function 00007FF684CA1E40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1DE8

Part of subcall function 00007FF684CA2D10: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF684CA2EA3,?,?,00007FF684DE80B0,00007FF684CA1341), ref: 00007FF684CA2D38

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF684CA1E09
Partial loss of significance (PLOSS), xrefs: 00007FF684CA1E40

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-4283191376
Opcode ID: 1dd5da9c229a70ada05a7e72007c3019867bc0f42a8cd2a6a57b758e29778a7c
Instruction ID: 7db4e64c6ce78e6c4d1e9a4155817aff22720376460d20014e847c1c93fcc729
Opcode Fuzzy Hash: 1dd5da9c229a70ada05a7e72007c3019867bc0f42a8cd2a6a57b758e29778a7c
Instruction Fuzzy Hash: E7F04F52818E94C1D212DF18E8800ABB374FF5D789F24572AEA893A565DF28D643C700

Function 00007FF684CA1E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1DE8

Part of subcall function 00007FF684CA2D10: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF684CA2EA3,?,?,00007FF684DE80B0,00007FF684CA1341), ref: 00007FF684CA2D38

Strings

Total loss of significance (TLOSS), xrefs: 00007FF684CA1E70
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF684CA1E09

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-4273532761
Opcode ID: c07508efb556dd7d9436ad69a9c8cf14d73a933b674d1fa630a59242d617e301
Instruction ID: 02fba8e9660c043da9bfb18096f6e6ac7a525a88319494913af4eb2749f1e94e
Opcode Fuzzy Hash: c07508efb556dd7d9436ad69a9c8cf14d73a933b674d1fa630a59242d617e301
Instruction Fuzzy Hash: 60F06252818E94C1D202DF18E8800EBB374FF4D789F24572AEE8D3A565DF29D643C700

Function 00007FF684CA1E60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1DE8

Part of subcall function 00007FF684CA2D10: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF684CA2EA3,?,?,00007FF684DE80B0,00007FF684CA1341), ref: 00007FF684CA2D38

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF684CA1E60
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF684CA1E09

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-2187435201
Opcode ID: 6f4887e0862d6d8c7608ed520de72aa1c1cab4868c195c56012fd40921bf5bb0
Instruction ID: d722bfcf50ccc3ccea469e428d602501bb2bb9351f5e877030263b538533342e
Opcode Fuzzy Hash: 6f4887e0862d6d8c7608ed520de72aa1c1cab4868c195c56012fd40921bf5bb0
Instruction Fuzzy Hash: 36F04F52818E94C1D202DF18E8800ABB374FF4D789F24572AEE893A565DF28D643C700

Function 00007FF684CA1DC8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF684CA1DE8

Part of subcall function 00007FF684CA2D10: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,00007FF684CA2EA3,?,?,00007FF684DE80B0,00007FF684CA1341), ref: 00007FF684CA2D38

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF684CA1E09
Argument singularity (SIGN), xrefs: 00007FF684CA1DC8

Memory Dump Source

Source File: 00000000.00000002.2151529147.00007FF684CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA0000, based on PE: true

Associated: 00000000.00000002.2151508679.00007FF684CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DEE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152594307.00007FF684DF3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 2168557111-2468659920
Opcode ID: d698bc09131adaa0ad28450f15c71979d22552db26d579fbe3eb7f0cf40d9bdc
Instruction ID: 91be0574e4f99f7fe6332e3bfb3f40e0e2839064c2cc1d73edb3f1300fd9eff4
Opcode Fuzzy Hash: d698bc09131adaa0ad28450f15c71979d22552db26d579fbe3eb7f0cf40d9bdc
Instruction Fuzzy Hash: DBF01D52918E9482D202DF18E8801ABB374FF5E789F25572AEE893A665DF29D643C700

Function 00007FF684CE5FF0 Relevance: 5.2, Strings: 4, Instructions: 220COMMON

Download Yara Rule

Strings

d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_, xrefs: 00007FF684CE600C
string: control character U+0000 (NUL) must be escaped to \u0000, xrefs: 00007FF684CE62BA
tectData, xrefs: 00007FF684CE6245, 00007FF684CE6286
2@@5@AEBUOptions@23@@Z@, xrefs: 00007FF684CE5FFA

Memory Dump Source

Source File: 00000000.00000002.2151643563.00007FF684CA4000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF684CA4000, based on PE: true

Associated: 00000000.00000002.2152552232.00007FF684DE5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2152575108.00007FF684DE9000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff684ca0000_file.jbxd

Similarity

API ID:
String ID: 2@@5@AEBUOptions@23@@Z@$d@@@2@@std@@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@5@V65@AEAV?$unordered_set@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$hash@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@U?$equal_to@V?$basic_$string: control character U+0000 (NUL) must be escaped to \u0000$tectData
API String ID: 0-156699724
Opcode ID: cb4aced989983624153f6b5b94dd7c37db31cce8b12816e7082eb09c52f35428
Instruction ID: 3ee8b8797b34cbb3098a59feb08296df91f0476fc2b30230454d74f61648032c
Opcode Fuzzy Hash: cb4aced989983624153f6b5b94dd7c37db31cce8b12816e7082eb09c52f35428
Instruction Fuzzy Hash: 5F91C022B18B81C2E711DB25E4812AD73B4FF95788F88953AEE8D83746DF38E595C340

Analysis Process: attrib.exePID: 3548, Parent PID: 5748COMMON

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.1%
Total number of Nodes:	1819
Total number of Limit Nodes:	71

Executed Functions

Function 0000000140081580 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00000001400815C1
GetSystemMetrics.USER32 ref: 00000001400815CF
GetSystemMetrics.USER32 ref: 00000001400815DD
GetSystemMetrics.USER32 ref: 00000001400815EB
GetDC.USER32 ref: 00000001400815F5
GetDeviceCaps.GDI32 ref: 000000014008160B
GetDeviceCaps.GDI32 ref: 000000014008161B
CreateCompatibleDC.GDI32 ref: 0000000140081628
CreateCompatibleBitmap.GDI32 ref: 0000000140081640
SelectObject.GDI32 ref: 0000000140081656
BitBlt.GDI32 ref: 000000014008168C
SHCreateMemStream.SHLWAPI ref: 00000001400816C2
SelectObject.GDI32 ref: 00000001400816D8
DeleteDC.GDI32 ref: 00000001400816E1
ReleaseDC.USER32 ref: 00000001400816EC
DeleteObject.GDI32 ref: 00000001400816F5
EnterCriticalSection.KERNEL32 ref: 00000001400817EC
LeaveCriticalSection.KERNEL32 ref: 00000001400817FE
IStream_Size.SHLWAPI ref: 0000000140081835
IStream_Reset.SHLWAPI ref: 0000000140081846
IStream_Read.SHLWAPI ref: 00000001400818CB
SelectObject.GDI32 ref: 0000000140081925
DeleteDC.GDI32 ref: 000000014008192E
ReleaseDC.USER32 ref: 000000014008193B
DeleteObject.GDI32 ref: 0000000140081944

Strings

, xrefs: 0000000140081661

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: 8507eae6e127520d5fd2d5e599d7727f0d7f940a95fba6922d6dc85d00d11c1d
Instruction ID: 7acbdb5b1728fdebe35a056424210b53f97045402e049f6f50554125dd802b88
Opcode Fuzzy Hash: 8507eae6e127520d5fd2d5e599d7727f0d7f940a95fba6922d6dc85d00d11c1d
Instruction Fuzzy Hash: F9B13E32208BC086E761DB22E8547DEB7A5FBD9BC0F408515EA8E43B69DF7CC1858B50

Function 00000001400BB76C Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 00000001400BB819
GetLastError.KERNEL32 ref: 00000001400BB823
FindFirstFileW.KERNEL32 ref: 00000001400BB83A
GetLastError.KERNEL32 ref: 00000001400BB846
FindClose.KERNEL32 ref: 00000001400BB854
__std_fs_open_handle.LIBCPMT ref: 00000001400BB8E7
CloseHandle.KERNEL32 ref: 00000001400BB8FD
CloseHandle.KERNEL32 ref: 00000001400BBA70

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: bfb389c9a219f6e3a5f4b256f69d65311ef631e076c0c695385b0534e1d94cbf
Instruction ID: e43cbf2889c881592d797453b3e83a27f85f85a0e1f4208ea948725584557cef
Opcode Fuzzy Hash: bfb389c9a219f6e3a5f4b256f69d65311ef631e076c0c695385b0534e1d94cbf
Instruction Fuzzy Hash: A5918F31604E0147E7768F6BA8147AA26A0EB9D7F4F544314FBBA47BF4DBB8CA058700

Function 0000000140083A60 Relevance: 22.6, APIs: 3, Strings: 9, Instructions: 1618COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140082610: GetCurrentHwProfileW.ADVAPI32 ref: 000000014008264A

Part of subcall function 0000000140081F50: EnumDisplayDevicesW.USER32 ref: 000000014008205D

Part of subcall function 0000000140081E80: RegGetValueA.ADVAPI32 ref: 0000000140081EE7

Part of subcall function 0000000140081B60: GetUserNameW.ADVAPI32 ref: 0000000140081BA5

Part of subcall function 0000000140081C00: GetComputerNameW.KERNEL32 ref: 0000000140081C45

GlobalMemoryStatusEx.KERNEL32 ref: 0000000140084226
wcsftime.LIBCMT ref: 0000000140084A9F
GetModuleFileNameA.KERNEL32 ref: 0000000140084C61

Strings

user_name, xrefs: 0000000140083EC0
%d-%m-%Y, %H:%M:%S, xrefs: 0000000140084A8C
computer_name, xrefs: 0000000140084417
gpu, xrefs: 0000000140083FD0
ram, xrefs: 0000000140084313
system, xrefs: 0000000140083E6C, 0000000140083F7C, 0000000140084092, 0000000140084184, 00000001400842BF, 00000001400843C1, 00000001400844C4, 0000000140084667, 0000000140084887, 0000000140084B33, 0000000140084D0F, 0000000140084F5A, 0000000140085112, 00000001400852D3, 0000000140085392
time, xrefs: 0000000140084B87
cpu, xrefs: 00000001400840E6
timezone, xrefs: 0000000140084FAE

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Name$ComputerCurrentDevicesDisplayEnumFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 4154315062-1182675529
Opcode ID: e2add8a9b6dc879c2399997afe7a11ec08e9ac9fd2808bc2de6f960079b52043
Instruction ID: 81603b826d2a0a0d7b23b5cd3d8acb831499e8318948b933adb4b2440ebc7b43
Opcode Fuzzy Hash: e2add8a9b6dc879c2399997afe7a11ec08e9ac9fd2808bc2de6f960079b52043
Instruction Fuzzy Hash: FE035B73614BC589EB228F65D8803DD37A1F799788F509216EB9D17BAAEF74C284C700

Function 000000014003D930 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 864
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 000000014003DA0D
GetProcAddress.KERNEL32 ref: 000000014003DB0B
GetProcAddress.KERNEL32 ref: 000000014003DBCF
GetProcAddress.KERNEL32 ref: 000000014003DC4A
GetProcAddress.KERNEL32 ref: 000000014003DCCF
GetProcAddress.KERNEL32 ref: 000000014003DD4A
GetProcAddress.KERNEL32 ref: 000000014003DDCF
FreeLibrary.KERNEL32 ref: 000000014003E8F8

Strings

vault, xrefs: 000000014003E74F
cannot use push_back() with , xrefs: 000000014003E94A
system, xrefs: 000000014003E6FB

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: fc1c4ef483ef86d24e2d3782b80fc56eaf6377bdc0ca023e7ec5893cc03d9ada
Instruction ID: 8ce8de93697553b4eeb946b80e2a49e7aa0d382d9d6c57aa8f8402b38374bf21
Opcode Fuzzy Hash: fc1c4ef483ef86d24e2d3782b80fc56eaf6377bdc0ca023e7ec5893cc03d9ada
Instruction Fuzzy Hash: 92924D32605BC48AEB628F2AE8443DE77B4F789798F504215EB9C57BA9EF34C654C700

Function 0000000140078020 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 256
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014007B120: GetCurrentProcess.KERNEL32 ref: 000000014007B15B
Part of subcall function 000000014007B120: OpenProcessToken.ADVAPI32 ref: 000000014007B16C
Part of subcall function 000000014007B120: GetTokenInformation.ADVAPI32 ref: 000000014007B1A4

ExitProcess.KERNEL32 ref: 000000014007807E
OpenMutexA.KERNEL32 ref: 00000001400781A3
ExitProcess.KERNEL32 ref: 00000001400781B3
CreateMutexA.KERNEL32 ref: 00000001400781D8
ExitProcess.KERNEL32 ref: 0000000140078201

Part of subcall function 000000014007B510: GetModuleFileNameW.KERNEL32 ref: 000000014007B55A

Part of subcall function 0000000140086460: CoInitializeEx.OLE32 ref: 00000001400864C5

Strings

SeDebugPrivilege, xrefs: 0000000140078085
SeImpersonatePrivilege, xrefs: 0000000140078091

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Process$Exit$MutexOpenToken$CreateCurrentFileInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 470559343-3768118664
Opcode ID: 27d7f94316964863325b27f389168ecd7c90451abd8ed8b0671e222d8601362b
Instruction ID: 9b187cf00e7220f93e114ed37885140c84941edb2b52332920d67cea5f3d9ee1
Opcode Fuzzy Hash: 27d7f94316964863325b27f389168ecd7c90451abd8ed8b0671e222d8601362b
Instruction Fuzzy Hash: 20B17C72258B8481FA22AB66E4453DEA361FB8DBD0F504615FB9D43AFADF7CC1818700

Function 00000001400A22FC Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000001400A2341

Part of subcall function 00000001400A19AC: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A19C0

Part of subcall function 000000014009CF0C: HeapFree.KERNEL32 ref: 000000014009CF22
Part of subcall function 000000014009CF0C: GetLastError.KERNEL32 ref: 000000014009CF2C

Part of subcall function 00000001400AAD20: _invalid_parameter_noinfo.LIBCMT ref: 00000001400AAC6B

_get_daylight.LIBCMT ref: 00000001400A2330

Part of subcall function 00000001400A1A0C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A1A20

_get_daylight.LIBCMT ref: 00000001400A25A6
_get_daylight.LIBCMT ref: 00000001400A25B7
_get_daylight.LIBCMT ref: 00000001400A25C8
GetTimeZoneInformation.KERNEL32 ref: 00000001400A25EF

Strings

Eastern Standard Time, xrefs: 00000001400A2695
Eastern Summer Time, xrefs: 00000001400A26AD

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: 698478b1b6a5c3b2bc9f12d9f458d4d9d17b33579bfc92f55f84ff21dc36e5c8
Instruction ID: 5f9a1437c7f8d517a1c1ecab5cd7933d90f0a7c4f415f6426a54c213b5c2d337
Opcode Fuzzy Hash: 698478b1b6a5c3b2bc9f12d9f458d4d9d17b33579bfc92f55f84ff21dc36e5c8
Instruction Fuzzy Hash: 78D1927670064086EB26EF2BD8917E96761F7ACBD4F448235FF49476A5EB38C481CB40

Function 0000000140080CC0 Relevance: 13.9, APIs: 9, Instructions: 377
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 0000000140080EF2

Part of subcall function 00000001400AE0F0: EnterCriticalSection.KERNEL32 ref: 00000001400AE100

InternetOpenUrlA.WININET ref: 0000000140080F62
HttpQueryInfoW.WININET ref: 0000000140080FBA
HttpQueryInfoW.WININET ref: 0000000140081043
InternetQueryDataAvailable.WININET ref: 0000000140081081
InternetReadFile.WININET ref: 000000014008113B
InternetQueryDataAvailable.WININET ref: 0000000140081201
InternetCloseHandle.WININET ref: 00000001400812A1
Concurrency::cancel_current_task.LIBCPMT ref: 00000001400812E1

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskCriticalEnterFileHandleReadSection
String ID:
API String ID: 2604747929-0
Opcode ID: fc8e716130ba1c2eaac3aa80c3733a8122ffad3a7fe1aabccc742a6cd15a0ec3
Instruction ID: 1dbb50cf0e822a0a1ee51d8925ea7e92eca3ec5a1efa77562424804ef6e08756
Opcode Fuzzy Hash: fc8e716130ba1c2eaac3aa80c3733a8122ffad3a7fe1aabccc742a6cd15a0ec3
Instruction Fuzzy Hash: 64026A32A24B9489FB41CB66E8407DD77B4F788B98F105215EF8D57BA9EB78C190C740

Function 000000014007A8F0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 452
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 000000014007AB0F
SetFilePointer.KERNEL32 ref: 000000014007ABC2
ReadFile.KERNEL32 ref: 000000014007ABF1

Strings

ios_base::eofbit set, xrefs: 000000014007B0D8
exists, xrefs: 000000014007B076
ios_base::badbit set, xrefs: 000000014007B09D, 000000014007B0C5
ios_base::failbit set, xrefs: 000000014007B0D1

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 60ae549cd09654dd77f6d63a7e445a6d39d7dc781ab6ffb3b1b573d33629ef86
Instruction ID: 6e7277c2f2bf3e65c043dad3a6f9a30a4daf752c77f676818b4faf36ced6b71b
Opcode Fuzzy Hash: 60ae549cd09654dd77f6d63a7e445a6d39d7dc781ab6ffb3b1b573d33629ef86
Instruction Fuzzy Hash: AC32F832610BC489EB21CF29D8907DD37A1F789788F448226EB9D57BA9EF78C644C740

Function 000000014009EFBC Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009F3EE

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 427383641610129416f573c26b965a5f8a43f8b4abaa2b5a5e0b46760301a0eb
Instruction ID: 28e3d62006f04d764d18e357617f00b682677e3e14f1594278f1befba5bee7e6
Opcode Fuzzy Hash: 427383641610129416f573c26b965a5f8a43f8b4abaa2b5a5e0b46760301a0eb
Instruction Fuzzy Hash: 45C1BE3221868596EB63AB2784443FE7BA0F789BC4F454205FB4A077F6DB79C964D700

Function 00000001400A2578 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00000001400A25A6

Part of subcall function 00000001400A1A0C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A1A20

_get_daylight.LIBCMT ref: 00000001400A25B7

Part of subcall function 00000001400A19AC: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A19C0

_get_daylight.LIBCMT ref: 00000001400A25C8

Part of subcall function 00000001400A19DC: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A19F0

Part of subcall function 000000014009CF0C: HeapFree.KERNEL32 ref: 000000014009CF22
Part of subcall function 000000014009CF0C: GetLastError.KERNEL32 ref: 000000014009CF2C

GetTimeZoneInformation.KERNEL32 ref: 00000001400A25EF

Strings

Eastern Standard Time, xrefs: 00000001400A2695
Eastern Summer Time, xrefs: 00000001400A26AD

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 0ae11ad46cd81f6c93aaa0b28e02eb80d6f50b1472f3390bab8a3a525c7da756
Instruction ID: e537b2c3748d4322202140d7b937f7a2868f3844b4be761c317a2bdade9b3c28
Opcode Fuzzy Hash: 0ae11ad46cd81f6c93aaa0b28e02eb80d6f50b1472f3390bab8a3a525c7da756
Instruction Fuzzy Hash: E8516D3671064086F722EF27E9917DA7761F79CBC4F444226BB4947AB6EB38C581CB40

Function 0000000140037350 Relevance: 9.5, APIs: 2, Strings: 3, Instructions: 716
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32 ref: 000000014003742F
FindNextFileW.KERNEL32 ref: 0000000140037C14

Strings

exists, xrefs: 0000000140038044
content, xrefs: 0000000140037AFF
filename, xrefs: 0000000140037A0A

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: FileFind$FirstNext
String ID: content$exists$filename
API String ID: 1690352074-1949714836
Opcode ID: 842a16ec2cc265db877fe287da46744b050d55632ce7bc0ab0c3224e999598cb
Instruction ID: c5a4031df7cb2cac97028a6fb0f62d4e23affc364100a5da7bf483d348cfcbcb
Opcode Fuzzy Hash: 842a16ec2cc265db877fe287da46744b050d55632ce7bc0ab0c3224e999598cb
Instruction Fuzzy Hash: EE623D72218BC495EB22DB26E4843DEB361F7897D4F405226EB9D47AB9DF78C584CB00

Function 0000000140098E40 Relevance: 9.2, APIs: 6, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140098E62
_get_daylight.LIBCMT ref: 0000000140098EC2
_get_daylight.LIBCMT ref: 0000000140098ED3
_get_daylight.LIBCMT ref: 0000000140098EE4
_isindst.LIBCMT ref: 0000000140098F35
_isindst.LIBCMT ref: 0000000140098F88

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: c344a62bfee50d7b7fbbc143855967662656a4f3c5d66f4e064aeb2ebf8cc7c4
Instruction ID: 6851f70fb8c59bf304261e9a75d5106a6c2d977e829eda7b7fe21ff05f12678d
Opcode Fuzzy Hash: c344a62bfee50d7b7fbbc143855967662656a4f3c5d66f4e064aeb2ebf8cc7c4
Instruction Fuzzy Hash: 8F81C7B27003458BEB699F6AC9513EC27A5E758BC8F449125FF098B7A9EB38D541CB00

Function 000000014008AAE0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 408
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000000014008AC90
__std_exception_destroy.LIBVCRUNTIME ref: 000000014008AC9E
__std_exception_destroy.LIBVCRUNTIME ref: 000000014008AF2D
__std_exception_destroy.LIBVCRUNTIME ref: 000000014008AF3B

Strings

value, xrefs: 000000014008ABB6, 000000014008AE5D

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 4180194a8f72ce03a4426ffaf4264c672f8da8c9f32f2015f9558bc1c3083e86
Instruction ID: 2621742d02532884c3c62fb704f9cbaf3c811e7d5093b1875ff6d8ddd0068dcc
Opcode Fuzzy Hash: 4180194a8f72ce03a4426ffaf4264c672f8da8c9f32f2015f9558bc1c3083e86
Instruction Fuzzy Hash: 10026B73624BC085EB028B7AD4403DE6761F79A7E4F505212FBAE47AEADB78C185C740

Function 000000014003E9C0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 324processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003EA08
Process32FirstW.KERNEL32 ref: 000000014003EA4A
Process32NextW.KERNEL32 ref: 000000014003EC49
CloseHandle.KERNEL32 ref: 000000014003EEBB

Strings

[PID: , xrefs: 000000014003EA84

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: e8760c4122b5e206d13a60dd8bb374aff66f33b366b5263b0fe5acfbe14def08
Instruction ID: d5bd4b332294735c4a4318e86d028a2b98b82f15b1953de4464851af110fdf6b
Opcode Fuzzy Hash: e8760c4122b5e206d13a60dd8bb374aff66f33b366b5263b0fe5acfbe14def08
Instruction Fuzzy Hash: 0BE16C72214BC086EB26DF26E8903DE7765F7897A8F504215EB9D07AE9DF78C285C700

Function 0000000140080480 Relevance: 6.4, APIs: 4, Instructions: 431networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 000000014008065E
recv.WS2_32 ref: 0000000140080B79
closesocket.WS2_32 ref: 0000000140080B8B
WSACleanup.WS2_32 ref: 0000000140080B91

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 9bf1adc63f5191077d9431a5a3bc39b484351e088680c12ae9aeaad8ae1ee760
Instruction ID: c201989313ac52d89c996de4872a965f228b5b157725633adba4060b4a065da8
Opcode Fuzzy Hash: 9bf1adc63f5191077d9431a5a3bc39b484351e088680c12ae9aeaad8ae1ee760
Instruction Fuzzy Hash: 89128073618BC481EB229B26E4543DAA761F79D7D0F504612EBAD43AFADF78C180CB10

Function 00000001400878B0 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000001400878FA
OpenProcessToken.ADVAPI32 ref: 000000014008790B
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140087929
AdjustTokenPrivileges.ADVAPI32 ref: 000000014008796F

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 2349140579-0
Opcode ID: fbf7b0cc3bc22610d5552f091d41485e4fe28e08ce852d67ae269c7227012baa
Instruction ID: 0b6256a4ccffb7d8118ccf1aa076f4c82f8cc2a9e2f4d9c68c669bcde3123048
Opcode Fuzzy Hash: fbf7b0cc3bc22610d5552f091d41485e4fe28e08ce852d67ae269c7227012baa
Instruction Fuzzy Hash: 8A212A32218B8086E621CB12E44079AB7A4FB8DBD0F959126FBCE47B68DF78C5418B40

Function 0000000140083040 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 0000000140083386

Strings

[UTC, xrefs: 0000000140083353

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: InformationTimeZone
String ID: [UTC
API String ID: 565725191-1715286942
Opcode ID: cbcfeccc56f0404e1d7aa4c25a4bf5f24f5c1e198b83cc6711815d20937e9379
Instruction ID: 108d166495ca799403ef54c779e24d2b383bbe75e95818d2f86b3665d95b3fdd
Opcode Fuzzy Hash: cbcfeccc56f0404e1d7aa4c25a4bf5f24f5c1e198b83cc6711815d20937e9379
Instruction Fuzzy Hash: 0291E532629FC48AD7918F29E88179EB3B4F399784F106219FE9D57B19EB34C254C740

Function 0000000140073B40 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000000140073B98
LocalFree.KERNEL32 ref: 0000000140073C2A

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 1f152763ec19e619bfc368bf77117f477a0b79e9407e037414c49aea0ab6e5f4
Instruction ID: 1bf4ef7dcfcad00e6f050f5eeeed7628fd77ba7299689734fd65fb5fb8b7e31d
Opcode Fuzzy Hash: 1f152763ec19e619bfc368bf77117f477a0b79e9407e037414c49aea0ab6e5f4
Instruction Fuzzy Hash: 61414232614B80CAF3218F75E4403ED37A4F75878CF444229EB8917E9ADB79C2A4C754

Function 0000000140082D90 Relevance: 1.7, APIs: 1, Instructions: 160COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 0000000140082E01

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: af8766a1a653f9afb03a4df2a6fc78b3e1ba998be69a67b48ad1bfa209858650
Instruction ID: bd68a7ba88a643a028a711c26e8c652d744391138e2c00afbeb78304b4bb3afe
Opcode Fuzzy Hash: af8766a1a653f9afb03a4df2a6fc78b3e1ba998be69a67b48ad1bfa209858650
Instruction Fuzzy Hash: C1715C33A18B8082E711CF25E48039EB7B5F798798F105215FB9813ABADB78D2D1DB44

Function 0000000140081B60 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0000000140081BA5

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 974e4f322e43ef909849fbc456c3f4976db81938fc0d4d45dcd05a562f6cf0af
Instruction ID: 0a2244c00ca32d0d979f4fdf9b7fc3b15d2c1ab24080606c7e4cb6e306690b80
Opcode Fuzzy Hash: 974e4f322e43ef909849fbc456c3f4976db81938fc0d4d45dcd05a562f6cf0af
Instruction Fuzzy Hash: F201217261878186E761DF26E8413DAB3A4FB9C788F441226F78D47669DBBCC1948B40

Function 000000014007A4D0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014007A250: InitializeCriticalSectionEx.KERNEL32 ref: 000000014007A2A1
Part of subcall function 000000014007A250: GetLastError.KERNEL32 ref: 000000014007A2AB

EnterCriticalSection.KERNEL32 ref: 000000014007A511
GdiplusStartup.GDIPLUS ref: 000000014007A538
LeaveCriticalSection.KERNEL32 ref: 000000014007A546
LeaveCriticalSection.KERNEL32 ref: 000000014007A574
GdipGetImageEncodersSize.GDIPLUS ref: 000000014007A582
GdipGetImageEncoders.GDIPLUS ref: 000000014007A616
GdipCreateBitmapFromScan0.GDIPLUS ref: 000000014007A6DA
GdipSaveImageToStream.GDIPLUS ref: 000000014007A6F8
GdipDisposeImage.GDIPLUS ref: 000000014007A75D
GdipDisposeImage.GDIPLUS ref: 000000014007A771

Strings

&, xrefs: 000000014007A6D4

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: 8835fc14b8c0fd5262807f6dd3a58a869a1510dc22799758eb5ac62de40f1462
Instruction ID: 38c664c037f79f00e76d2e271b55282c61ee8f4cc1c68833e08fad2d1326c5a7
Opcode Fuzzy Hash: 8835fc14b8c0fd5262807f6dd3a58a869a1510dc22799758eb5ac62de40f1462
Instruction Fuzzy Hash: BF915E36200B859AEB26CF22E840BD937A4F79DBD8F558215FB0947BA4EB3CC595C340

Function 000000014007B650 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 286
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400812F0: GetUserGeoID.KERNEL32 ref: 0000000140081315
Part of subcall function 00000001400812F0: GetGeoInfoA.KERNEL32 ref: 000000014008132D
Part of subcall function 00000001400812F0: GetGeoInfoA.KERNEL32 ref: 000000014008137D

WSAStartup.WS2_32 ref: 000000014007B76E
socket.WS2_32 ref: 000000014007B78B
htons.WS2_32 ref: 000000014007B7B1
inet_pton.WS2_32 ref: 000000014007B8A6
connect.WS2_32 ref: 000000014007B8C0
closesocket.WS2_32 ref: 000000014007B8E3
WSACleanup.WS2_32 ref: 000000014007B8E9

Strings

system, xrefs: 000000014007B6DB
geo, xrefs: 000000014007B71B

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: da89b18c45df3b7cb4ffe36055a4c0a58308284c6d25d434c3def7dd7b007e54
Instruction ID: 662e9e5062e619ee5eaf2d028ce49d3b070395de269e488d2a712fe453693d6c
Opcode Fuzzy Hash: da89b18c45df3b7cb4ffe36055a4c0a58308284c6d25d434c3def7dd7b007e54
Instruction Fuzzy Hash: 90C1AB72714A8485FB129F66D4443DC7376E74CBD4F405626EB6A27AFAEE38C546C300

Function 00000001400C36A8 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400C3288: _invalid_parameter_noinfo.LIBCMT ref: 00000001400C32C9
Part of subcall function 00000001400C3288: _invalid_parameter_noinfo.LIBCMT ref: 00000001400C3349
Part of subcall function 00000001400C3288: _invalid_parameter_noinfo.LIBCMT ref: 00000001400C339D
Part of subcall function 00000001400C3288: _get_daylight.LIBCMT ref: 00000001400C33F5

CreateFileW.KERNEL32 ref: 00000001400C37AE
CreateFileW.KERNEL32 ref: 00000001400C37FE
GetLastError.KERNEL32 ref: 00000001400C382E
GetFileType.KERNEL32 ref: 00000001400C3843
GetLastError.KERNEL32 ref: 00000001400C384D
CloseHandle.KERNEL32 ref: 00000001400C3880
CloseHandle.KERNEL32 ref: 00000001400C39E4
CreateFileW.KERNEL32 ref: 00000001400C3A19
GetLastError.KERNEL32 ref: 00000001400C3A28

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 490799599c57ad564ab0fcf16f8555b356a9328dbb73e8c96f5ba99975714cec
Instruction ID: 7925b1bc4626db2df41809a69d40e7813c49447d39d3539b5f5eb353443ccaf8
Opcode Fuzzy Hash: 490799599c57ad564ab0fcf16f8555b356a9328dbb73e8c96f5ba99975714cec
Instruction Fuzzy Hash: 6BC1AC36728B4086EB25CFAAD4907ED3B61E34DBE8F015309EB6A977A4DB35C556C300

Function 000000014007A330 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 000000014007A373
EnterCriticalSection.KERNEL32 ref: 000000014007A385
EnterCriticalSection.KERNEL32 ref: 000000014007A395
GdiplusShutdown.GDIPLUS ref: 000000014007A3A3
LeaveCriticalSection.KERNEL32 ref: 000000014007A3B0
LeaveCriticalSection.KERNEL32 ref: 000000014007A3BA

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 9312ee92e43017e15c80159da1815fefed654e82bb603727025027d9faa898aa
Instruction ID: 6e800591289b1b958dbc267e63b95a5c78e17ec1863c6d83043539bfc95367e5
Opcode Fuzzy Hash: 9312ee92e43017e15c80159da1815fefed654e82bb603727025027d9faa898aa
Instruction Fuzzy Hash: F511E632111B9081EB129F26E84439D7364FB88FA8F688215FB6D476B4EF39C997C350

Function 000000014008080E Relevance: 4.7, APIs: 3, Instructions: 186networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 0000000140080B79
closesocket.WS2_32 ref: 0000000140080B8B
WSACleanup.WS2_32 ref: 0000000140080B91

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: 2e5fa39f8d788ae15f55805ae352d6bf687d26d5b6e855cda861c4eabf628b45
Instruction ID: f1ad65e566db8d56104e5002ef3795829c0597c371e9b30b1d3988138c39b960
Opcode Fuzzy Hash: 2e5fa39f8d788ae15f55805ae352d6bf687d26d5b6e855cda861c4eabf628b45
Instruction Fuzzy Hash: 81915073614BC481EA268B2AE4453DEA721F79DBE4F505311EBAD07AEADF78C181C710

Function 00000001400903B4 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400903DB

Part of subcall function 0000000140090370: _invalid_parameter_noinfo.LIBCMT ref: 0000000140090387

_invalid_parameter_noinfo.LIBCMT ref: 0000000140090488
_local_unwind.LIBVCRUNTIME ref: 0000000140090499

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_local_unwind
String ID:
API String ID: 1677304287-0
Opcode ID: 2d0cb57732f71c7861a18988631ea2dcdbba9467b0616a14b128760128b0135d
Instruction ID: c9135e651182ec7ef32d28b115c1b320e5b2e09d5bd9a6f31a5e72c3a114a952
Opcode Fuzzy Hash: 2d0cb57732f71c7861a18988631ea2dcdbba9467b0616a14b128760128b0135d
Instruction Fuzzy Hash: 9C219C72620A448AEA56EB16E8913ED3365F79DBD4F944211FB4A473F2DB39C654C300

Function 00000001400812F0 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 0000000140081315
GetGeoInfoA.KERNEL32 ref: 000000014008132D
GetGeoInfoA.KERNEL32 ref: 000000014008137D

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: f0b6ba3127188870d9ca77e4cdfddb0e206f65f9be5dd170d7b6ddfbdcbbc9f0
Instruction ID: 5f9ab726204127fcecfcc2675b989eceadf73ed3b1207f0f22be86ce81961314
Opcode Fuzzy Hash: f0b6ba3127188870d9ca77e4cdfddb0e206f65f9be5dd170d7b6ddfbdcbbc9f0
Instruction Fuzzy Hash: C1119D7362479086D7118F62F454B9EB3A1FB98BC8F045224EB8503B69EF7CD594CB84

Function 000000014007B120 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 000000014007B15B
OpenProcessToken.ADVAPI32 ref: 000000014007B16C
GetTokenInformation.ADVAPI32 ref: 000000014007B1A4

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: d270990935d05291609a27100eb666b5b0fbef0ab6ff9c34a914c4aa256aee9f
Instruction ID: 7d4d56d9fa040bcd168dd546eb2ab8de2c4673392563bf712e4f6970bc1867fe
Opcode Fuzzy Hash: d270990935d05291609a27100eb666b5b0fbef0ab6ff9c34a914c4aa256aee9f
Instruction Fuzzy Hash: 20110A72218B8186E7518F16F85078BB7B4FB88B84F849225FB8A47B68DF7CD455CB40

Function 00000001400A43AC Relevance: 4.5, APIs: 3, Instructions: 15COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00000001400A43BD
TerminateProcess.KERNEL32 ref: 00000001400A43C8
ExitProcess.KERNEL32 ref: 00000001400A43D7

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8eb0a8c4b131ff86e2201643d666c16c7870ab94c2bf69e596262afad84de1cc
Instruction ID: 2365d90791e986f2a727615bc03a77a4ae7a8324cf26ba53d7bce3ad59984ead
Opcode Fuzzy Hash: 8eb0a8c4b131ff86e2201643d666c16c7870ab94c2bf69e596262afad84de1cc
Instruction Fuzzy Hash: DED09E3D31171482EB5A7B7668D57DD12615F9C7C5F401A38BB0747BB3EE39848E4610

Function 0000000140047940 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140047A99

Strings

cannot use operator[] with a numeric argument with , xrefs: 0000000140047E69

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot use operator[] with a numeric argument with
API String ID: 118556049-485864652
Opcode ID: 9a2ec3b0cc3da9766dac5e37370d2a63ca4c330877e530557692c63393320a9d
Instruction ID: f5bad0dc291c2e2ed61cf1a991e4da9de59e05c1d597257095e3d27b27032456
Opcode Fuzzy Hash: 9a2ec3b0cc3da9766dac5e37370d2a63ca4c330877e530557692c63393320a9d
Instruction Fuzzy Hash: 0631F27230578085EE16DB17A5087DCA356A748BE4F180B31AF7D0BBE6DA78C5A18308

Function 0000000140078216 Relevance: 3.1, APIs: 2, Instructions: 132synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 000000014003E9C0: CreateToolhelp32Snapshot.KERNEL32 ref: 000000014003EA08
Part of subcall function 000000014003E9C0: Process32FirstW.KERNEL32 ref: 000000014003EA4A

Part of subcall function 000000014003CDE0: CredEnumerateA.ADVAPI32 ref: 000000014003CE42

Part of subcall function 0000000140082D90: GetLogicalDriveStringsW.KERNEL32 ref: 0000000140082E01

ReleaseMutex.KERNEL32 ref: 00000001400783C7
CloseHandle.KERNEL32 ref: 00000001400783D0

Part of subcall function 0000000140037350: FindFirstFileW.KERNEL32 ref: 000000014003742F

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: First$CloseCreateCredDriveEnumerateFileFindHandleLogicalMutexProcess32ReleaseSnapshotStringsToolhelp32
String ID:
API String ID: 1242419452-0
Opcode ID: 2a8e4913302f608f44babd115b0cf2680b0270ae9856bbe6e494cef3fa44f7e9
Instruction ID: 748de06db89f56bcdcb57a80fb8047b59612c0f970b08029c33e2f8c4310ae84
Opcode Fuzzy Hash: 2a8e4913302f608f44babd115b0cf2680b0270ae9856bbe6e494cef3fa44f7e9
Instruction Fuzzy Hash: 3F517C72654A8441FA22AB2BE0453DE6352AB8DBE0F545211FBAD17AFBDE7CC0818700

Function 000000014007824A Relevance: 3.1, APIs: 2, Instructions: 121synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0000000140082D90: GetLogicalDriveStringsW.KERNEL32 ref: 0000000140082E01

ReleaseMutex.KERNEL32 ref: 00000001400783C7
CloseHandle.KERNEL32 ref: 00000001400783D0

Part of subcall function 0000000140037350: FindFirstFileW.KERNEL32 ref: 000000014003742F

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: CloseDriveFileFindFirstHandleLogicalMutexReleaseStrings
String ID:
API String ID: 3179890297-0
Opcode ID: 7540eafd819b28442b57375ef9155a7cce12f6d8c2c082102260d290eff2ba41
Instruction ID: c0d2c7fed480eec1cfe9d79b94d055446cfe1a5d26624a7e6dbb8324abf26adc
Opcode Fuzzy Hash: 7540eafd819b28442b57375ef9155a7cce12f6d8c2c082102260d290eff2ba41
Instruction Fuzzy Hash: D6518C72654AC441FA329B2AE0453DE6352EB8DBE0F545312FFAD17AEADE7CC0818700

Function 000000014007A7A0 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 000000014007A7F9
CoTaskMemFree.OLE32 ref: 000000014007A8BA

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 37415099ad387ae43774670f15801e1a7372ea81981d43541a6168cbfb7c6b27
Instruction ID: b8e95fa56b30fdb0023a51b1be703f0894ae9977bd5e5f76aed81624ebd50f44
Opcode Fuzzy Hash: 37415099ad387ae43774670f15801e1a7372ea81981d43541a6168cbfb7c6b27
Instruction Fuzzy Hash: 93315372914B8481E7218F2AE48039AB761F7DDBE4F505315FBAD07AA9DF7CC1818B40

Function 000000014009F530 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 000000014009F57C
GetLastError.KERNEL32 ref: 000000014009F586

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: aae81a2dd0585ac03914996930617a7374804057a0023572312201c9d4728205
Instruction ID: 72c744fa8e5dc1ff14c32ef57c9a2c0f625bdc24d4400b57af55c7e5e922e97a
Opcode Fuzzy Hash: aae81a2dd0585ac03914996930617a7374804057a0023572312201c9d4728205
Instruction Fuzzy Hash: 56119E72204B8081EA21DB2AA4443ADA761A789FF4FA54311FF7A4B7E9DE78C1518700

Function 00000001400AE200 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400AE230

Part of subcall function 00000001400AF020: std::bad_alloc::bad_alloc.LIBCMT ref: 00000001400AF029

Concurrency::cancel_current_task.LIBCPMT ref: 00000001400AE236

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: cb30be615b2a740bb91050d633ba98dd94f54af7fee1c5634fd4bcc6230015a6
Instruction ID: fc8930262ab32eab3bd104a898b23aed0cd21ee4062b3fc4e665a17430962243
Opcode Fuzzy Hash: cb30be615b2a740bb91050d633ba98dd94f54af7fee1c5634fd4bcc6230015a6
Instruction Fuzzy Hash: DEE0E2A061124645FE2A26A3281A3E411480B2D7F0F281B20BB754B2E7A93889D28A10

Function 000000014009CF0C Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 000000014009CF22
GetLastError.KERNEL32 ref: 000000014009CF2C

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 45209dc9db24084941d5b4e6ac6d9946b256a9172249de886d3448e3530a5b4a
Instruction ID: b590ebf0d0b224aabd4ccf73cdfdbaf80e0e20b688dd46ba616e7d568d858a8d
Opcode Fuzzy Hash: 45209dc9db24084941d5b4e6ac6d9946b256a9172249de886d3448e3530a5b4a
Instruction Fuzzy Hash: EEE0EC70B2160442FE1B67B758597AE02525F9C7C1F4440646B09872B2E93485954210

Function 000000014008F370 Relevance: 1.7, APIs: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 000000014008F5B7

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: f557cecd5e0577b148bb0491fa87b0300d06998ab9ba3dd4ae8ab662c60691aa
Instruction ID: d7debb1f34da7971ef8d2a0c2bbb4e1c522ce9d578eb9b013e2a5ce506d514c1
Opcode Fuzzy Hash: f557cecd5e0577b148bb0491fa87b0300d06998ab9ba3dd4ae8ab662c60691aa
Instruction Fuzzy Hash: 63616C33201A8485EA26DE6B90543BD7361F749FE4F959622EF6E4B7E1DF38C5819300

Function 0000000140047AB0 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000000140047C48

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 476ce1fecc353de413fc8332848cc0940288fd447011ffcb3c5ee369f453a5ed
Instruction ID: c7d030a3ecbe7d3d3e0d1d88f105e82d357067209a2854074c08e7336d0d632d
Opcode Fuzzy Hash: 476ce1fecc353de413fc8332848cc0940288fd447011ffcb3c5ee369f453a5ed
Instruction Fuzzy Hash: 2541BD32304B8481EA26EF27A5447DAB365F748BE4F584A25EFAD077EADF38C4418344

Function 0000000140030160 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 0000000140030273

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: 0774b3d9213ff1652328d42d257ed2440927087ae2c5d6503d9ddf9be0d73473
Instruction ID: 49f32ad9aa8c52940ced2e7b0f0bfcfe32909ef633f5e2c6e1672cc1b2165abe
Opcode Fuzzy Hash: 0774b3d9213ff1652328d42d257ed2440927087ae2c5d6503d9ddf9be0d73473
Instruction Fuzzy Hash: 0541CD73601A4482EA239B1AE5583AB6361E78DBF4F544325FF69477E5EF38C5C18700

Function 0000000140081CA0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 000000014007B2E0: __std_fs_get_current_path.LIBCPMT ref: 000000014007B358

GetVolumeInformationW.KERNEL32 ref: 0000000140081D30

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: InformationVolume__std_fs_get_current_path
String ID:
API String ID: 155845060-0
Opcode ID: d6d1497e9b231d35f782c5648b1e4ee71e09ed8b787a088405192df33d1219b7
Instruction ID: ef89591a8d52536fb15e5c5a6e6083a2c416713c222d085306f93125d8700a7a
Opcode Fuzzy Hash: d6d1497e9b231d35f782c5648b1e4ee71e09ed8b787a088405192df33d1219b7
Instruction Fuzzy Hash: 7A518A33A14B8089EB12CF69E8443DE7764F799788F504216EB8953AA9DF78C685CB40

Function 000000014009D408 Relevance: 1.6, APIs: 1, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009D430

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 071ebb08b0fc02b9d3ef8c25180f68ab3a457de1887feec64baca47ad46b2841
Instruction ID: 827b9f23f064e195f1fd80acc8c7da2f9e5b97116b6af4902af03383d44fa2e2
Opcode Fuzzy Hash: 071ebb08b0fc02b9d3ef8c25180f68ab3a457de1887feec64baca47ad46b2841
Instruction Fuzzy Hash: 2D41AE32250A4087EA369B1EE5413EA77A0E759BC8F550206FB9A877F1CB79D402CB51

Function 0000000140047159 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01cf2dcc710f72c2a1b72338f7bbd675db8e59d2117eb95be9309cd29dc07e6b
Instruction ID: 81e14a1b91022de0ee63eca7bada4234bd81b760ef366483a7f5e4603f685b7c
Opcode Fuzzy Hash: 01cf2dcc710f72c2a1b72338f7bbd675db8e59d2117eb95be9309cd29dc07e6b
Instruction Fuzzy Hash: 7D31A472305A4085FE26DB57A6047DDA362E74CBE0F594631FB6E0B7E9DA78C4918308

Function 000000014009EEA0 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000014009EF97

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fb2abcc3e97f28c6e70c47a0fd1fa5229a04abe3fde6ae5ca4541a6dce7644a9
Instruction ID: 7ad071255414eab1b55e36e777b76eb34705a6988f923fab3ccff09a3d6beabb
Opcode Fuzzy Hash: fb2abcc3e97f28c6e70c47a0fd1fa5229a04abe3fde6ae5ca4541a6dce7644a9
Instruction Fuzzy Hash: 1D31823261468086F717AF57D8913EE3B61A79CBE5F550216FB29073F2CB78C8518711

Function 00000001400A42DD Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000001400A430B

Part of subcall function 00000001400A4410: GetModuleHandleExW.KERNEL32 ref: 00000001400A4435
Part of subcall function 00000001400A4410: GetProcAddress.KERNEL32 ref: 00000001400A444B
Part of subcall function 00000001400A4410: FreeLibrary.KERNEL32 ref: 00000001400A4472

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: a6d988fad7f82c8ed6f6a36b49a2ab38b1c706cf5ea4fa191dba1a8892074849
Instruction ID: d5c9464d6b8d2a054bfb961884ae510d6a27d2236e52e3d99c9fbd0b5c1faed8
Opcode Fuzzy Hash: a6d988fad7f82c8ed6f6a36b49a2ab38b1c706cf5ea4fa191dba1a8892074849
Instruction Fuzzy Hash: AF218C36A007008EEF268F65C4403EC37A0E798798F08472AE76C47EE9DB74C685CB81

Function 00000001400BE3F8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400BE355

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 77eb78eceebaf9aac1283afbdc11339d6bb147956a1b1fa3eec95f7ad3fa8818
Instruction ID: 846f15da9fc3c56ecc9e08d8bb7cb848960d564921cfaf608a2463cb41289ea9
Opcode Fuzzy Hash: 77eb78eceebaf9aac1283afbdc11339d6bb147956a1b1fa3eec95f7ad3fa8818
Instruction Fuzzy Hash: A9118432218AC081EA62AF9394003EDB6F4B79DFC0F484021FF895B7A6DB7DCA508700

Function 00000001400C2F4C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400C2F6F

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a50a0b47cc8fb1f1aa58c7d522dfd3dac9cb2a3c51579a89a64ad1e107e1cc06
Instruction ID: ea5a2193af0cbf518e3f6b5f7f94f62ae3233ac40b7671baedc464373216cbbb
Opcode Fuzzy Hash: a50a0b47cc8fb1f1aa58c7d522dfd3dac9cb2a3c51579a89a64ad1e107e1cc06
Instruction Fuzzy Hash: 17216632218B8487DB6A9F1AD49039977B0F798BD4F644239FB59876E5DB39C8418B00

Function 0000000140037BD1 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 0000000140037C14

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 2a33c8ed0ea8a7ff33b4bf5881203da667c28cb78f46e6057f686215caa0375e
Instruction ID: 5aca283b3c95ff823a9037a8aa05f053069595e5bdb8907956f138cbc61f99fe
Opcode Fuzzy Hash: 2a33c8ed0ea8a7ff33b4bf5881203da667c28cb78f46e6057f686215caa0375e
Instruction Fuzzy Hash: 05014F36218A8180EA72CB53F44479BB320F78CBD4F404022DF8D43B68DE39C886CB00

Function 0000000140090AB4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140090AD3

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ae8ffb49856a14d60f99efa49b0fe83e22d235a8448dcdbc0ad68fd56e97e18
Instruction ID: 0c767e3cbc4931c4aa8882f63e94758b56fa545a3ce8bdd11540b7d769112b3b
Opcode Fuzzy Hash: 3ae8ffb49856a14d60f99efa49b0fe83e22d235a8448dcdbc0ad68fd56e97e18
Instruction Fuzzy Hash: C4E0D831215B8145FB677BBB95813ED7150AF4C7F4F144321BB38036E6DA3488604702

Function 00000001400BB67C Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 00000001400BB680

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: ed1b562b9eaccad4d1a8cb5c87ebc476f475394f3bf74eab8c21655979839179
Instruction ID: 981c6749304d533e8fdbedb094f8015d6330da6e913776a4b914b8757997fcb7
Opcode Fuzzy Hash: ed1b562b9eaccad4d1a8cb5c87ebc476f475394f3bf74eab8c21655979839179
Instruction Fuzzy Hash: DFC09B38F15911C2E75A1B775C82B8913E09B5C780F540210D34881270E97C85E79721

Function 00000001400BCFA0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 00000001400BCFA9

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 2207f1aaff4f69cd87f85f70297096fb5378e3f094066669bafcd2760b152ba3
Instruction ID: f2dd737eda34713f0cce8303110b871d3b707fbabb630c02e0f133b95e01dc4e
Opcode Fuzzy Hash: 2207f1aaff4f69cd87f85f70297096fb5378e3f094066669bafcd2760b152ba3
Instruction Fuzzy Hash: DAB09236A248C0C3C612EB04EC426497331FB98B08FD00000E38D43624EF2CCA2A8E10

Function 000000014009F8AC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 000000014009F8EA

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: eb99e2a0aa2c5a543b3daa01bf1a85af620a59f00b68e4e07b531dba3724a22a
Instruction ID: 9e91537f030aa400b32e62a5d8ac1f2b6596a14e99e6149370d123651f872c09
Opcode Fuzzy Hash: eb99e2a0aa2c5a543b3daa01bf1a85af620a59f00b68e4e07b531dba3724a22a
Instruction Fuzzy Hash: F5F0303070138549FE9767B75951BFA22805B8C7E0F1C07207F3A876F2DE38C481A620

Non-executed Functions

Function 0000000140086060 Relevance: 37.8, APIs: 18, Strings: 3, Instructions: 1064stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 00000001400860A2
NtAllocateVirtualMemory.NTDLL ref: 00000001400860D7
lstrcpyW.KERNEL32 ref: 0000000140086173
lstrcatW.KERNEL32 ref: 0000000140086264
NtAllocateVirtualMemory.NTDLL ref: 0000000140086322
lstrcpyW.KERNEL32 ref: 00000001400863D7
RtlInitUnicodeString.NTDLL ref: 00000001400863EC
RtlInitUnicodeString.NTDLL ref: 0000000140086401
LdrEnumerateLoadedModules.NTDLL ref: 0000000140086414
RtlReleasePebLock.NTDLL ref: 000000014008641A

Part of subcall function 000000014007A7A0: SHGetKnownFolderPath.SHELL32 ref: 000000014007A7F9
Part of subcall function 000000014007A7A0: CoTaskMemFree.OLE32 ref: 000000014007A8BA

CoInitializeEx.OLE32 ref: 00000001400864C5
lstrcpyW.KERNEL32 ref: 00000001400866CE
lstrcatW.KERNEL32 ref: 0000000140086905
CoGetObject.OLE32 ref: 0000000140086921
lstrcpyW.KERNEL32 ref: 0000000140087081
lstrcatW.KERNEL32 ref: 00000001400872E2
CoGetObject.OLE32 ref: 00000001400872FE
CoUninitialize.OLE32 ref: 0000000140087872

Strings

bbb, xrefs: 0000000140086179
aaa, xrefs: 0000000140086124
ccc, xrefs: 000000014008626A

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize
String ID: aaa$bbb$ccc
API String ID: 1424456515-3079797815
Opcode ID: f0b7a16c3e847143c70db0fec26786c2ad8d8c6e76ed255575291fbbb71af5a4
Instruction ID: b923225278945e31d1e214b42046eec2a27db5636e5914fbe7de8292be46462c
Opcode Fuzzy Hash: f0b7a16c3e847143c70db0fec26786c2ad8d8c6e76ed255575291fbbb71af5a4
Instruction Fuzzy Hash: 0DD28336629FC58AD7A18F69E88179EB3B4F788B88F105215EFCD57B18EB38C1548740

Function 0000000140070D50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 0000000140070E06
CoInitializeSecurity.OLE32 ref: 0000000140070EC3

Strings

@, xrefs: 0000000140070FF6

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Initialize$Security
String ID: @
API String ID: 119290355-2766056989
Opcode ID: e59b98966bda130ea35d372dae056438257616fd67346b0219cdfdf902116535
Instruction ID: 67c53c2c2d814d0a9250b11d1f1d9bb412a14425931474304dd3d9427839a308
Opcode Fuzzy Hash: e59b98966bda130ea35d372dae056438257616fd67346b0219cdfdf902116535
Instruction Fuzzy Hash: 67D17772B04B848AEB12CFB6E4547DD3361EB8CB98F404615EF5A17AA9DF78C095C344

Function 0000000140085920 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 362nativelibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00000001400AE0F0: EnterCriticalSection.KERNEL32 ref: 00000001400AE100

GetModuleHandleA.KERNEL32 ref: 000000014008599A
GetProcAddress.KERNEL32 ref: 00000001400859AA
OpenProcess.KERNEL32 ref: 00000001400859ED
NtQuerySystemInformation.NTDLL ref: 0000000140085A14
NtQuerySystemInformation.NTDLL ref: 0000000140085A3F
GetCurrentProcess.KERNEL32 ref: 0000000140085B0B
NtQueryObject.NTDLL ref: 0000000140085B58
GetFinalPathNameByHandleA.KERNEL32 ref: 0000000140085C52
CloseHandle.KERNEL32 ref: 0000000140085D66
CloseHandle.KERNEL32 ref: 0000000140085DEE

Strings

File, xrefs: 0000000140085B8C
NtDuplicateObject, xrefs: 00000001400859A3
ntdll.dll, xrefs: 0000000140085993

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCriticalCurrentEnterFinalModuleNameObjectOpenPathProcSection
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2066483518-3955674919
Opcode ID: e594203d8851b2cba567bebb7f27c6ffd0b35645b79d28f4c6519c117bc5403b
Instruction ID: 4f27cde101778101ecd7cab267c446bc3dafccd890f1742b76eda9cda1e43c20
Opcode Fuzzy Hash: e594203d8851b2cba567bebb7f27c6ffd0b35645b79d28f4c6519c117bc5403b
Instruction Fuzzy Hash: 49E18D72710B848AFB16AFA6D4543ED3762F748BD8F408625EF4927BA9DB34C645C340

Function 0000000140076D60 Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 472COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400AE0F0: EnterCriticalSection.KERNEL32 ref: 00000001400AE100

ShellExecuteW.SHELL32 ref: 00000001400772F5

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 0000000140076E7B
ios_base::eofbit set, xrefs: 0000000140077536
open, xrefs: 000000014007726C
runas, xrefs: 0000000140077275
temp_directory_path, xrefs: 00000001400774FB
.exe, xrefs: 0000000140076E34
ios_base::badbit set, xrefs: 0000000140077524
ios_base::failbit set, xrefs: 000000014007752F
.exe, xrefs: 0000000140076E0B

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: CriticalEnterExecuteSectionShell
String ID: .exe$.exe$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas$temp_directory_path
API String ID: 4038919937-3845196099
Opcode ID: e200e1a29eb46e4a5ff2b6316c9a2ce6143466b816e6ac2a742d2c4bea0fa9f7
Instruction ID: 7cbde7a1c2cb2ca04f7e1c7201835cb8b3a5905d3ea1d6bc7fa7a4196d7a7de0
Opcode Fuzzy Hash: e200e1a29eb46e4a5ff2b6316c9a2ce6143466b816e6ac2a742d2c4bea0fa9f7
Instruction Fuzzy Hash: F9328B72610B8089EB11DF6AE8847DE77A1F7887A8F505216FB5E07AB9DB78C185C700

Function 00000001400A80AC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000140099B94: GetLastError.KERNEL32 ref: 0000000140099BA3
Part of subcall function 0000000140099B94: FlsGetValue.KERNEL32 ref: 0000000140099BB8
Part of subcall function 0000000140099B94: SetLastError.KERNEL32 ref: 0000000140099C43

TranslateName.LIBCMT ref: 00000001400A8119
TranslateName.LIBCMT ref: 00000001400A8154
GetACP.KERNEL32 ref: 00000001400A8199
IsValidCodePage.KERNEL32 ref: 00000001400A81C1

Strings

utf8, xrefs: 00000001400A82A5

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: 7b07d4ff2d2c8ac8aae54d70d264f8f5fd38b117be414cfb2d7e50e751da9c84
Instruction ID: e67117c05542a16c3d237f6d918e56036c799c5066030088a6dac1a7e0b76059
Opcode Fuzzy Hash: 7b07d4ff2d2c8ac8aae54d70d264f8f5fd38b117be414cfb2d7e50e751da9c84
Instruction Fuzzy Hash: E4917D32200B4086EB769F63D8417EA27A5F7ACBC4F448225BF59477A5EB38C596CB40

Function 00000001400A8AE0 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000140099B94: GetLastError.KERNEL32 ref: 0000000140099BA3
Part of subcall function 0000000140099B94: FlsGetValue.KERNEL32 ref: 0000000140099BB8
Part of subcall function 0000000140099B94: SetLastError.KERNEL32 ref: 0000000140099C43

Part of subcall function 0000000140099B94: FlsSetValue.KERNEL32 ref: 0000000140099BD9

GetUserDefaultLCID.KERNEL32 ref: 00000001400A8C50

Part of subcall function 0000000140099B94: FlsSetValue.KERNEL32 ref: 0000000140099C06
Part of subcall function 0000000140099B94: FlsSetValue.KERNEL32 ref: 0000000140099C17
Part of subcall function 0000000140099B94: FlsSetValue.KERNEL32 ref: 0000000140099C28

EnumSystemLocalesW.KERNEL32 ref: 00000001400A8C37
ProcessCodePage.LIBCMT ref: 00000001400A8C7A
IsValidCodePage.KERNEL32 ref: 00000001400A8C8C
IsValidLocale.KERNEL32 ref: 00000001400A8CA2
GetLocaleInfoW.KERNEL32 ref: 00000001400A8CFE
GetLocaleInfoW.KERNEL32 ref: 00000001400A8D1A

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 3d25f31d395c3ae3e3608586c5fefc0b956f88d735d05026e9ed1f693fc9eb64
Instruction ID: 63c079c9bdc3934e62a49766a8657e039bd4138966bf6506c00c4e0c34cff1be
Opcode Fuzzy Hash: 3d25f31d395c3ae3e3608586c5fefc0b956f88d735d05026e9ed1f693fc9eb64
Instruction Fuzzy Hash: 6E717C727107108AFF669B62D8507EC33A0BB6CBC8F444625EF19576E5EB38C985CB60

Function 00000001400665D0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 408COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000000140066780
__std_exception_destroy.LIBVCRUNTIME ref: 000000014006678E
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140066A1D
__std_exception_destroy.LIBVCRUNTIME ref: 0000000140066A2B

Strings

value, xrefs: 00000001400666A6, 000000014006694D

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: 4459256ee55020a31ff87e32e83d014d1221c33cab15f4399cce6727210ce636
Instruction ID: 360b10f0aa72913117fbd999b4c056a8fb455a009dc272f4eaf6707da87cb4e5
Opcode Fuzzy Hash: 4459256ee55020a31ff87e32e83d014d1221c33cab15f4399cce6727210ce636
Instruction Fuzzy Hash: A0026D32624BC089EB02CB7AD8403DE6761E7997E4F605712FB9D53AEADB78C185C700

Function 0000000140091688 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000000140091701
RtlLookupFunctionEntry.KERNEL32 ref: 0000000140091719
RtlVirtualUnwind.KERNEL32 ref: 0000000140091754
IsDebuggerPresent.KERNEL32 ref: 000000014009178D
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000140091797
UnhandledExceptionFilter.KERNEL32 ref: 00000001400917A2

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2d623047d3aecc7385336590f9e49eab95d49ea2abbdc5ec59ad4e6f52a05f12
Instruction ID: 84cf17d4c7d3108b2b180c25b472523c4d0c7ea9f2d81cd25f0633b2042140d4
Opcode Fuzzy Hash: 2d623047d3aecc7385336590f9e49eab95d49ea2abbdc5ec59ad4e6f52a05f12
Instruction Fuzzy Hash: 09314F36214B8086DB61CF66E8407EE73A4F788794F544225FB9D43BA9EF38C546CB00

Function 0000000140094A50 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 0000000140094ABA
memcpy_s.LIBCPMT ref: 0000000140094AE5

Strings

, xrefs: 0000000140094C18

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: 1b748593274e8ddd9ac1e908b2a22b3d8043b10f383cd2471e7c6bd1e5b959b4
Instruction ID: 34293ee4bd884ca1a5d113340ea240fef62ce90f8ec454a1e98fd0f960cfc058
Opcode Fuzzy Hash: 1b748593274e8ddd9ac1e908b2a22b3d8043b10f383cd2471e7c6bd1e5b959b4
Instruction Fuzzy Hash: 40C1F6727156858BEB65CF1AE088F9EB791F3987C8F448225EB4A47B94D738D805CB40

Function 00000001400BD6E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400BD741
IsDebuggerPresent.KERNEL32 ref: 00000001400BD759
OutputDebugStringW.KERNEL32 ref: 00000001400BD76A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00000001400BD763

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 9f2ba7ac1ffdfb54cd24e7aa69bef8e5fd03b463d21a3b8ac8ac174eb3ea57fd
Instruction ID: 04c1f3162799c90fa18bfa9d0fdfa597dbb09a44218ac3b5afe7244516e8db41
Opcode Fuzzy Hash: 9f2ba7ac1ffdfb54cd24e7aa69bef8e5fd03b463d21a3b8ac8ac174eb3ea57fd
Instruction Fuzzy Hash: 58113C32210B9097FB569B67EA543E933B4FB4C795F404125A74983AA0FF38D4B4C750

Function 0000000140098CE0 Relevance: 6.1, APIs: 4, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 0000000140098D30
GetSystemInfo.KERNEL32 ref: 0000000140098D47
VirtualAlloc.KERNEL32 ref: 0000000140098DB4
VirtualProtect.KERNEL32 ref: 0000000140098DCE

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 0563650b0593b8a3372685d5b5ba1ed04743c52572833c5a6095c6b83099c874
Instruction ID: 7b29950938f5d1eb1f1057a13fe2bbe9f8d3e4bead821d60fa31d514101dd8cb
Opcode Fuzzy Hash: 0563650b0593b8a3372685d5b5ba1ed04743c52572833c5a6095c6b83099c874
Instruction Fuzzy Hash: 23312F32311A949EEB21DF36D8407D933A5F75CB88F444126AE0E8BB99DF38D645C750

Function 000000014006A660 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 366COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000000014006A8BA

Strings

value, xrefs: 000000014006B596
parse_error, xrefs: 000000014006A6EC

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: __std_exception_copy
String ID: parse_error$value
API String ID: 592178966-1739288027
Opcode ID: 594008a15763408666559e2e9687e6c47fb96841d2a711eed68f262bb4e26c07
Instruction ID: 5fcd192059ae7d40b4fc9f5b92788c6f353c03fb8b32c6bf07e2948d10f9e21b
Opcode Fuzzy Hash: 594008a15763408666559e2e9687e6c47fb96841d2a711eed68f262bb4e26c07
Instruction Fuzzy Hash: 93F1BC72B10A8494FB02EF76D8413ED6322E7997D8F905612EB5D17AEAEB78C185C340

Function 00000001400BB330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00000001400BB356
FormatMessageA.KERNEL32 ref: 00000001400BB385

Strings

!x-sys-default-locale, xrefs: 00000001400BB349

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: c1628e58b74db45d6c1c166ba316052c12fc9305e6d311366bbb753391ec371b
Instruction ID: ee3019a1607bff4b850c8d5276a856c598ae6c010dbfced3cef60c4648155c67
Opcode Fuzzy Hash: c1628e58b74db45d6c1c166ba316052c12fc9305e6d311366bbb753391ec371b
Instruction Fuzzy Hash: 8E018472714B8483E7528B62F454BE9B7A1F78C7D4F444115E74943BA8CB7CC645C701

Function 00000001400A8560 Relevance: 4.7, APIs: 3, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140099B94: GetLastError.KERNEL32 ref: 0000000140099BA3
Part of subcall function 0000000140099B94: FlsGetValue.KERNEL32 ref: 0000000140099BB8
Part of subcall function 0000000140099B94: SetLastError.KERNEL32 ref: 0000000140099C43

Part of subcall function 0000000140099B94: FlsSetValue.KERNEL32 ref: 0000000140099BD9

GetLocaleInfoW.KERNEL32 ref: 00000001400A85CC

Part of subcall function 000000014008FC54: _invalid_parameter_noinfo.LIBCMT ref: 000000014008FC71

GetLocaleInfoW.KERNEL32 ref: 00000001400A8615

Part of subcall function 000000014008FC54: _invalid_parameter_noinfo.LIBCMT ref: 000000014008FCCA

GetLocaleInfoW.KERNEL32 ref: 00000001400A86E0

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: e67600567bfe96fbbb60148a47ae1074da6cf3433536b878f09fbb7db3c093e2
Instruction ID: 3250d0611f82e919bd07214604e52a085f39cddba797da83e5303319a7d8c9f6
Opcode Fuzzy Hash: e67600567bfe96fbbb60148a47ae1074da6cf3433536b878f09fbb7db3c093e2
Instruction Fuzzy Hash: B061B4322046418AEB359F22E5403ED73A1F7ACBC0F548225EF9A936E5DB38D595CB00

Function 000000014009DB64 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 000000014009DBD8

Strings

GetLocaleInfoEx, xrefs: 000000014009DB80, 000000014009DB91

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 7158f00e854bc0a64802fd91f42c5edb2a8ca4e8e68280abc9d613188f6456ce
Instruction ID: 5df82f3035c796c9833f9b0ac1052cadc78fbd90198fa1db922be0fbb3987b3a
Opcode Fuzzy Hash: 7158f00e854bc0a64802fd91f42c5edb2a8ca4e8e68280abc9d613188f6456ce
Instruction Fuzzy Hash: 14016931704A8086EB069B57B4407DAB7A1EB8CBD0F584426FF4D53BBACE38CA428740

Function 0000000140038060 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00000001400380ED
LocalFree.KERNEL32 ref: 000000014003817F

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 3f01dd70acda989559950bac7c6ce8da687c370d4f84c80b7e33fb28e5680184
Instruction ID: 2c56df0f6b7fe195d8ab3dd192573ab1076b12a6302c88be85a928adc98b6aa1
Opcode Fuzzy Hash: 3f01dd70acda989559950bac7c6ce8da687c370d4f84c80b7e33fb28e5680184
Instruction Fuzzy Hash: 94616A32B10B809AFB22DFB5E4503DE73A5E75978CF008225FF8917A99DB78C1958344

Function 0000000140073E40 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32 ref: 0000000140073E98
LocalFree.KERNEL32 ref: 0000000140073F2A

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 1b1f0b59f50daae5b913928cb930c74407ec3cf0d3c045937b738d3d3b56883e
Instruction ID: 487597bf66b3906908a9818e8a41d1dd645e71feaf2304e6cd687c69599107e4
Opcode Fuzzy Hash: 1b1f0b59f50daae5b913928cb930c74407ec3cf0d3c045937b738d3d3b56883e
Instruction Fuzzy Hash: 7F412232614B80CAF3218F75E4403ED37A4F75878CF444629FB8907E9ADB79C6A48754

Function 00000001400A87AC Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140099B94: GetLastError.KERNEL32 ref: 0000000140099BA3
Part of subcall function 0000000140099B94: FlsGetValue.KERNEL32 ref: 0000000140099BB8
Part of subcall function 0000000140099B94: SetLastError.KERNEL32 ref: 0000000140099C43

Part of subcall function 0000000140099B94: FlsSetValue.KERNEL32 ref: 0000000140099BD9

GetLocaleInfoW.KERNEL32 ref: 00000001400A8814

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 26972a3f8ec8664294c930cd51fb86fe8abaacfcc16369afc2f7ca5bbb20aff8
Instruction ID: a0cab8b25ff71ef6b22773c3f09fb607e25bff2e546453f5d41f5ddc3141f955
Opcode Fuzzy Hash: 26972a3f8ec8664294c930cd51fb86fe8abaacfcc16369afc2f7ca5bbb20aff8
Instruction Fuzzy Hash: 8E317E3260068186EB79DF27E5413EA73A1FB9C7C4F848225AF59832A5DF3CD9958B40

Function 00000001400A83F8 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000140099B94: GetLastError.KERNEL32 ref: 0000000140099BA3
Part of subcall function 0000000140099B94: FlsGetValue.KERNEL32 ref: 0000000140099BB8
Part of subcall function 0000000140099B94: SetLastError.KERNEL32 ref: 0000000140099C43

EnumSystemLocalesW.KERNEL32 ref: 00000001400A8496

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 545877f1b48be7b9932d6e1bd4acb48e8ec6ab1aa6b15a7524e22e0cca3c5db5
Instruction ID: a51ea0ab000cc3dfd680d4ee4bb78ce126f552227a412868a4e57a41080536f0
Opcode Fuzzy Hash: 545877f1b48be7b9932d6e1bd4acb48e8ec6ab1aa6b15a7524e22e0cca3c5db5
Instruction Fuzzy Hash: B711D673A146448AEB268F16D0407EC7BA1F368FE0F448225EB65433E0D734C5D1CB40

Function 00000001400A89B4 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0000000140099B94: GetLastError.KERNEL32 ref: 0000000140099BA3
Part of subcall function 0000000140099B94: FlsGetValue.KERNEL32 ref: 0000000140099BB8
Part of subcall function 0000000140099B94: SetLastError.KERNEL32 ref: 0000000140099C43

GetLocaleInfoW.KERNEL32 ref: 00000001400A89EB

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: fe6d65bc296aa4c948ab69cfea43ae809ff16573e1c5ee61f01f6c506c0a908a
Instruction ID: 10372d9deee32bd296c56e200d6745ea7de78220619460b3e25ca986d8c60a03
Opcode Fuzzy Hash: fe6d65bc296aa4c948ab69cfea43ae809ff16573e1c5ee61f01f6c506c0a908a
Instruction Fuzzy Hash: 361125326182A083FBB69B13E0407E922A1E778BE0F105327FF69076E5DB75C8C18B01

Function 00000001400A84C8 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000000140099B94: GetLastError.KERNEL32 ref: 0000000140099BA3
Part of subcall function 0000000140099B94: FlsGetValue.KERNEL32 ref: 0000000140099BB8
Part of subcall function 0000000140099B94: SetLastError.KERNEL32 ref: 0000000140099C43

EnumSystemLocalesW.KERNEL32 ref: 00000001400A8546

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 9a12b1fb76cf22861b2f448ca0e92b673a6715a3d8d74ac81b673a24401075ac
Instruction ID: ab4f1f4d7ac106faa2a67bd51681ca0f30e1138ec3efffad9f1a5adc633610c5
Opcode Fuzzy Hash: 9a12b1fb76cf22861b2f448ca0e92b673a6715a3d8d74ac81b673a24401075ac
Instruction Fuzzy Hash: FD01B172A046808AEB265B27F4407D976A1E768BE4F958321EF25472E4DB74C8C18B00

Function 000000014009D620 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 000000014009D66F

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 3ab42c288a21d81e2ffe37b664d861115ee0eba558140e8c864f0cc5d19cbbb4
Instruction ID: 78ef9602807423e242a0ea38a9212b2f99fc96f6c47c8dcba990794fa9f5bbf7
Opcode Fuzzy Hash: 3ab42c288a21d81e2ffe37b664d861115ee0eba558140e8c864f0cc5d19cbbb4
Instruction Fuzzy Hash: 83F01472300B4483E705DB2AE990BD92365F79DBC0F549126EB5983375EF38C9658740

Function 00000001400A9084 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001400A9088

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 821eb4daeda04d3c8aa90b2308e45ed5b1180566e4f4d070028705abe430cb4e
Instruction ID: acc1b05366cccbd76d9293523b6b0114d904872555dc885eff4670e25f93c100
Opcode Fuzzy Hash: 821eb4daeda04d3c8aa90b2308e45ed5b1180566e4f4d070028705abe430cb4e
Instruction Fuzzy Hash: 4CB09234A03A89C2EA0A2B126C8274923A47B8CB00F884119930D42330EB3C10B64B10

Function 00000001400D7008 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32622de27a61a8a2e5330a76705853dc24aae8fd8be83df1bd1a29b95d32b718
Instruction ID: 8061895d313a3bcd5ad51126a45877f99b8ea286b47d7ccf3b83f9bc6b2a3c0f
Opcode Fuzzy Hash: 32622de27a61a8a2e5330a76705853dc24aae8fd8be83df1bd1a29b95d32b718
Instruction Fuzzy Hash: CB5135AB54EAC04AF7A34A2A0C667CC1FD4EF6AB94F4D5146E744873E3F45A48068322

Function 00000001400D7090 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19410ad7230259186e62de70c501f604483edc097cd3d5680812bf89975e4c9
Instruction ID: f4926e5eaaec30b59a6ec3998276cba8c5ddb8ab5c1d13e9c54e759204d5da3f
Opcode Fuzzy Hash: d19410ad7230259186e62de70c501f604483edc097cd3d5680812bf89975e4c9
Instruction Fuzzy Hash: A631F0AF55EAC04AF3B349290CA77CC2FE4EB6AB54F4E5146D744873D3F55A480A8322

Function 00000001400D7098 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938643a2e72afeb32524c677afc066cef9a073125af7897a2a4558e983be0b23
Instruction ID: 44940e46665272858d9026c3291fb7c82fbecdcbe0f183109b5bb7cec3d570f7
Opcode Fuzzy Hash: 938643a2e72afeb32524c677afc066cef9a073125af7897a2a4558e983be0b23
Instruction Fuzzy Hash: 4E31B1AF54EAC14AF2B349290CA77CC2FE4EB6AB54F4E5146D744873D3F55A480A8322

Function 00000001400D76D0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802a02f397435f7a2983d68343294454bc351265127295eb8017025d374bf0fa
Instruction ID: 4a8609c3f0e89bfa2cd04c8ea72c5120382184179509efa3a5e72aed363f3d3a
Opcode Fuzzy Hash: 802a02f397435f7a2983d68343294454bc351265127295eb8017025d374bf0fa
Instruction Fuzzy Hash: 8001A56750EAC00BF7634A2A4C66B8C2F60AB5AF80F4D8457E394872D3F5194C578772

Function 00000001400D7100 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d140950b30a8c0819f409446343fd7a16b42e04218d9a303406ff1e5d3a830a6
Instruction ID: 1799708525bdddc13f49a387cca5bccd1344612a0c503987f8f434d036b036d8
Opcode Fuzzy Hash: d140950b30a8c0819f409446343fd7a16b42e04218d9a303406ff1e5d3a830a6
Instruction Fuzzy Hash: 6B01E1AF94D9C10AF6B3491E08D77CC1BD9EF6A798F091249DB048B3E3F966480B4212

Function 00000001400D76C0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47b12ad1dd9cb6d4a9d9e2362430c60ebee91eeab1b6ea40ce17222472a3128
Instruction ID: 78540e5299ba76ac7c74a2f19fc1c2b441bdd4ef5b5f379b0b393088ed1945eb
Opcode Fuzzy Hash: b47b12ad1dd9cb6d4a9d9e2362430c60ebee91eeab1b6ea40ce17222472a3128
Instruction Fuzzy Hash: D5C04C9B50A9C406F173551E0459BCC2F949B16B50E88544DD7E446162B45544474A66

Function 00000001400D7720 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c39617187c66315793016437c6cda029c4f5dd06a6cc6bee0d9654a8a4072c9
Instruction ID: 203ed785ae7c57f520fe977b5c607e435b600b22d8b6d4786c73795fd436a206
Opcode Fuzzy Hash: 5c39617187c66315793016437c6cda029c4f5dd06a6cc6bee0d9654a8a4072c9
Instruction Fuzzy Hash: 47B0124350C2E124C3034624402895B6F2055C2400B9C82FEC3D117A83D58C1054C352

Function 0000000140070A40 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000000140070A94
Process32FirstW.KERNEL32 ref: 0000000140070AD8
Process32NextW.KERNEL32 ref: 0000000140070AED
OpenProcess.KERNEL32 ref: 0000000140070B2B
OpenProcessToken.ADVAPI32 ref: 0000000140070B52
GetTokenInformation.ADVAPI32 ref: 0000000140070B7D
GetLastError.KERNEL32 ref: 0000000140070B8B
GetTokenInformation.ADVAPI32 ref: 0000000140070BCB
ConvertSidToStringSidA.ADVAPI32 ref: 0000000140070BE2
CloseHandle.KERNEL32 ref: 0000000140070C56
CloseHandle.KERNEL32 ref: 0000000140070C61
DuplicateTokenEx.ADVAPI32 ref: 0000000140070C96
CloseHandle.KERNEL32 ref: 0000000140070CAD

Part of subcall function 00000001400982DC: _invalid_parameter_noinfo.LIBCMT ref: 00000001400982F9

CloseHandle.KERNEL32 ref: 0000000140070CBB
CloseHandle.KERNEL32 ref: 0000000140070CC6
Process32NextW.KERNEL32 ref: 0000000140070CD3
CloseHandle.KERNEL32 ref: 0000000140070CF8
CloseHandle.KERNEL32 ref: 0000000140070D01
CloseHandle.KERNEL32 ref: 0000000140070D16

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: CloseHandle$Token$Process32$InformationNextOpenProcess$ConvertCreateDuplicateErrorFirstLastSnapshotStringToolhelp32_invalid_parameter_noinfo
String ID:
API String ID: 1854266383-0
Opcode ID: c6496b269248900584d7fd2b61856a7f51f25a84bdd1b29fe432eca5ef48a86e
Instruction ID: 0a6af3262ed0087e602f77b39e3d0d2059ca5fd9f98d819a84fa1aba99afca1b
Opcode Fuzzy Hash: c6496b269248900584d7fd2b61856a7f51f25a84bdd1b29fe432eca5ef48a86e
Instruction Fuzzy Hash: 1B811836214B80C6EB529B67E8507AEB7A4F788BD4F405215EF8D47BA8EF78C545CB00

Function 0000000140091B38 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140091B67
_invalid_parameter_noinfo.LIBCMT ref: 0000000140091C3D

Strings

0, xrefs: 0000000140091D3B
0, xrefs: 0000000140091C6C
0, xrefs: 0000000140091D25
0, xrefs: 0000000140091C7E

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0$0
API String ID: 3215553584-3558443385
Opcode ID: cb6153525aa798686fad21c2e9d9cf714d1e4191a1d43d2486d7861d2780c7f4
Instruction ID: d65c986ca340be5fea91ae015ff08865670063a256b4a82c7e29f510a7f8066a
Opcode Fuzzy Hash: cb6153525aa798686fad21c2e9d9cf714d1e4191a1d43d2486d7861d2780c7f4
Instruction Fuzzy Hash: FBF1B43230AA9989F7638F2785503ED7BE5A399BC0F988012EB99477E6D739C555C300

Function 00000001400500A0 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 213COMMON

Download Yara Rule

Strings

key opened, but never closed, xrefs: 000000014005180F
No closed word, xrefs: 0000000140051777, 000000014005179A
unexpected key without object, xrefs: 000000014005174E
quote was opened but not closed., xrefs: 00000001400516A4, 000000014005170D
object is not closed with '}', xrefs: 0000000140051681
unexpected '}', xrefs: 000000014005185B
key declared, but no value, xrefs: 00000001400516C7, 00000001400516EA, 00000001400517EC
word wasnt properly ended, xrefs: 00000001400517BD, 0000000140051838

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID:
String ID: No closed word$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 0-2700065129
Opcode ID: 9fcd9b668a95f407d325d919b819b8c650df0833725703cd25a656c3a8d42033
Instruction ID: 58c3bc531708cdb88afb9f79fcc7e30f65ed040d56352c5498f019c403c5e272
Opcode Fuzzy Hash: 9fcd9b668a95f407d325d919b819b8c650df0833725703cd25a656c3a8d42033
Instruction Fuzzy Hash: 0EA17E32524EC594EB56EF22E8813DA3765FB8C388F905502F78A075B9DF78C689C300

Function 00000001400767D0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 173COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014007684E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140076897
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140076A13
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140076A26
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140076A2C

Strings

true, xrefs: 000000014007694B
bad locale name, xrefs: 0000000140076A19
false, xrefs: 000000014007691E

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: f759427ded3d1b3cabc39376bec70ff733624301768eaacd754337384279a6d8
Instruction ID: 80c3eb7a6a07223e04e5f0717b0c2e016bddd5f6b4aeeb11bbd2f16ac769cf8c
Opcode Fuzzy Hash: f759427ded3d1b3cabc39376bec70ff733624301768eaacd754337384279a6d8
Instruction Fuzzy Hash: CD713D32701B408AEB26DFB2E5503ED37B5EB88B88F144129AF4967BA9DF38C451D744

Function 0000000140085720 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0000000140085784
GetProcessId.KERNEL32 ref: 000000014008578D
RmStartSession.RSTRTMGR ref: 00000001400857BC
RmRegisterResources.RSTRTMGR ref: 00000001400857E5
RmGetList.RSTRTMGR ref: 000000014008581E
RmGetList.RSTRTMGR ref: 0000000140085880
RmEndSession.RSTRTMGR ref: 00000001400858BC

Part of subcall function 00000001400AE0F0: EnterCriticalSection.KERNEL32 ref: 00000001400AE100

RmEndSession.RSTRTMGR ref: 00000001400858F4
RmEndSession.RSTRTMGR ref: 0000000140085909

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Session$ListProcess$CriticalCurrentEnterRegisterResourcesSectionStart
String ID:
API String ID: 3572076967-0
Opcode ID: d817a67acd6db6480a775f706d479f0e5b7ae8bde52ed5eae0e180c41ccf0277
Instruction ID: 1c49036fe72cdc63f0beaf1dd1150fff1543ea9193bdff0cda437168c852a40e
Opcode Fuzzy Hash: d817a67acd6db6480a775f706d479f0e5b7ae8bde52ed5eae0e180c41ccf0277
Instruction Fuzzy Hash: 7D512932B10A408AF711DFA6E8407DD33B1B78CB99F404526EB4E63AA8EF34C945CB50

Function 0000000140095014 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140095058
_invalid_parameter_noinfo.LIBCMT ref: 0000000140095430
_invalid_parameter_noinfo.LIBCMT ref: 00000001400956DB

Strings

0, xrefs: 0000000140095480
p, xrefs: 000000014009510A
f, xrefs: 000000014009517A
p, xrefs: 0000000140095182

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: ddb5b90cffe7d2d3e0c664012388527694b11d3f7d0ea02711828fb826aaea95
Instruction ID: a3bd42d5379aa3d027f7814c4745283c46a02f78083dac8e034260718656a6b5
Opcode Fuzzy Hash: ddb5b90cffe7d2d3e0c664012388527694b11d3f7d0ea02711828fb826aaea95
Instruction Fuzzy Hash: C312AF7260564186FB66BE17E0547EEBBA2F3887D6FD84115FB9247AE4D738C9808B00

Function 000000014009D69C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000000014009D81B
GetProcAddress.KERNEL32 ref: 000000014009D827

Strings

ext-ms-, xrefs: 000000014009D778
api-ms-, xrefs: 000000014009D765

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 12135105b5f4dd6ea4bcef39dd476f6d9ed135b4d13e617c32e3e87089a7a057
Instruction ID: b274465ccf9ba22b4214f7b93b774bbea952c849d70e6785e4929c4053378e65
Opcode Fuzzy Hash: 12135105b5f4dd6ea4bcef39dd476f6d9ed135b4d13e617c32e3e87089a7a057
Instruction Fuzzy Hash: FE41CF72315A0081FB17DB6BA8047DA6395BB4DBE4F488126FF198B7A8FE3CC4468340

Function 0000000140076C10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 0000000140076C79
InternetOpenUrlA.WININET ref: 0000000140076CAE
InternetReadFile.WININET ref: 0000000140076CCF
InternetReadFile.WININET ref: 0000000140076D0F
InternetCloseHandle.WININET ref: 0000000140076D1C
InternetCloseHandle.WININET ref: 0000000140076D25

Strings

File Downloader, xrefs: 0000000140076C72

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 3ee79157f89af13d5e06345f82add2bd8ba9855f0618fbf83edde4809386b858
Instruction ID: 43130f5fe14bcf6d0d5455ae0f7443da92bbabf2d7a90802a4e63c9bf303fcac
Opcode Fuzzy Hash: 3ee79157f89af13d5e06345f82add2bd8ba9855f0618fbf83edde4809386b858
Instruction Fuzzy Hash: 5F317C32214B8486EB229F26E4507DAB361FB8DBC4F545115FF8A43B68EFBCD5918B00

Function 0000000140099B94 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140099BA3
FlsGetValue.KERNEL32 ref: 0000000140099BB8
FlsSetValue.KERNEL32 ref: 0000000140099BD9
FlsSetValue.KERNEL32 ref: 0000000140099C06
FlsSetValue.KERNEL32 ref: 0000000140099C17
FlsSetValue.KERNEL32 ref: 0000000140099C28
SetLastError.KERNEL32 ref: 0000000140099C43

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 23565e1f370c88a1e01d5dadd5e726acd3c17e7c91acbffbb25193025dd91155
Instruction ID: ae7cc464916aab66519ca55994373210c9e37001fa0b15fdcadb8524bd19fbcf
Opcode Fuzzy Hash: 23565e1f370c88a1e01d5dadd5e726acd3c17e7c91acbffbb25193025dd91155
Instruction Fuzzy Hash: C4213D7030864042FA6BA72B5A653ED63965B4CBF0F144725BB360BAF6DE79C4419701

Function 00000001400ABB28 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000001400ABB59
GetLastError.KERNEL32 ref: 00000001400ABB65
CloseHandle.KERNEL32 ref: 00000001400ABB7D
CreateFileW.KERNEL32 ref: 00000001400ABBA8
WriteConsoleW.KERNEL32 ref: 00000001400ABBC7

Strings

CONOUT$, xrefs: 00000001400ABB89

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 224f991252595473e360711b9ed6629489629b1a0c31b547de0f3402cf39e5f5
Instruction ID: dae0cd1da474ecd68c0f1ced87abecf25dda5365d3406c3d20bf62305c1cd903
Opcode Fuzzy Hash: 224f991252595473e360711b9ed6629489629b1a0c31b547de0f3402cf39e5f5
Instruction Fuzzy Hash: 80118831220B4086F7529B47E854799A7A4FB9CFE8F400224EB1E877B8DB78C8458B14

Function 00000001400BD314 Relevance: 9.2, APIs: 6, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00000001400BD3BD
MultiByteToWideChar.KERNEL32 ref: 00000001400BD460
MultiByteToWideChar.KERNEL32 ref: 00000001400BD501
MultiByteToWideChar.KERNEL32 ref: 00000001400BD54B
MultiByteToWideChar.KERNEL32 ref: 00000001400BD5E2
CompareStringEx.KERNEL32 ref: 00000001400BD615

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: f9a507bb13e9e0357262f9cd78c472a85d4b7cc200172b173b9b3c32d6c59667
Instruction ID: bc78d481dd2fb7fbb8cca10355bf95cf6853a50da0a75c496b8b6d5e7a1eecca
Opcode Fuzzy Hash: f9a507bb13e9e0357262f9cd78c472a85d4b7cc200172b173b9b3c32d6c59667
Instruction Fuzzy Hash: E8A19532605B8446FB368FA794507EAB7A1E748BE8F484226FB5D077E5EB78C9458300

Function 0000000140071290 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 471COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.ADVAPI32 ref: 0000000140071688
RevertToSelf.ADVAPI32 ref: 00000001400716A6

Strings

APPB, xrefs: 00000001400717C7

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ImpersonateLoggedRevertSelfUser
String ID: APPB
API String ID: 1724704203-1278849820
Opcode ID: 87a9713733893e0c6f88486d19aa8b1336c80bb1c49c683c8fdf6caa53c29ba1
Instruction ID: 394382830c3d6946c1531023e552b24c618bac6e5ce85e6df1867b8ffe842ff2
Opcode Fuzzy Hash: 87a9713733893e0c6f88486d19aa8b1336c80bb1c49c683c8fdf6caa53c29ba1
Instruction Fuzzy Hash: D3127E72B2068489FF029BBAD8553DD2B61E7897E8F505611FB6D17AEADF78C085C300

Function 00000001400BCFB8 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00000001400BD02A
MultiByteToWideChar.KERNEL32 ref: 00000001400BD0D2
LCMapStringEx.KERNEL32 ref: 00000001400BD109
LCMapStringEx.KERNEL32 ref: 00000001400BD162
LCMapStringEx.KERNEL32 ref: 00000001400BD20F
WideCharToMultiByte.KERNEL32 ref: 00000001400BD251

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 568cdcc071fa6e11a5db189a350f89fe32867b41da656cec5731020258f84116
Instruction ID: f92ab99a2f7cf35814a9fea9e2409f5534924b6a4e4aeff7fd1dbc8ba49c22d6
Opcode Fuzzy Hash: 568cdcc071fa6e11a5db189a350f89fe32867b41da656cec5731020258f84116
Instruction Fuzzy Hash: 7E81A972211B8086EB258FA6D4407D9B7F5FB58BE8F044616FF5957BE8EB38C8458700

Function 0000000140099D0C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000140099D1B
FlsSetValue.KERNEL32(?,?,8000000000000000,0000000140095E25,?,?,?,?,000000014009CF40), ref: 0000000140099D51
FlsSetValue.KERNEL32(?,?,8000000000000000,0000000140095E25,?,?,?,?,000000014009CF40), ref: 0000000140099D7E
FlsSetValue.KERNEL32(?,?,8000000000000000,0000000140095E25,?,?,?,?,000000014009CF40), ref: 0000000140099D8F
FlsSetValue.KERNEL32(?,?,8000000000000000,0000000140095E25,?,?,?,?,000000014009CF40), ref: 0000000140099DA0
SetLastError.KERNEL32 ref: 0000000140099DBB

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 10d7e0d626b1d7213abfa432a929936a6378427cef95495f276e26cdb1db6cb6
Instruction ID: 734ff71a785b52918bb9cba74f7067165adb3cd9db710ca5d33c78ad089c1033
Opcode Fuzzy Hash: 10d7e0d626b1d7213abfa432a929936a6378427cef95495f276e26cdb1db6cb6
Instruction Fuzzy Hash: 5C111C3030664042FA57A73B56A13ED63929B8DBF0F144725BB3A0B7FADE79C4518701

Function 000000014002FBB0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 000000014002FC0F

Part of subcall function 00000001400BB41C: AreFileApisANSI.KERNEL32 ref: 00000001400BB42E

__std_exception_destroy.LIBVCRUNTIME ref: 000000014002FEA7

Strings

", ", xrefs: 000000014002FCEB
: ", xrefs: 000000014002FCB8

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ApisFile__std_exception_destroy__std_fs_code_page
String ID: ", "$: "
API String ID: 376971205-747220369
Opcode ID: f7d98d6b7326af0b8cb237e3d9462c6c48a17a19d0a7430b07de30dba85b8ef0
Instruction ID: ea3f6e5f97bf6bdcbd0d103ee1ac1ffc8a51faede6db81c37d0ee239ede0a486
Opcode Fuzzy Hash: f7d98d6b7326af0b8cb237e3d9462c6c48a17a19d0a7430b07de30dba85b8ef0
Instruction Fuzzy Hash: BBA18772310A8495EB06DF6AE4543ED2362E748BC8F508536EF5D47BAADF78C896C340

Function 00000001400A4410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000001400A4435
GetProcAddress.KERNEL32 ref: 00000001400A444B
FreeLibrary.KERNEL32 ref: 00000001400A4472

Strings

CorExitProcess, xrefs: 00000001400A4444
mscoree.dll, xrefs: 00000001400A442C

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8a1d3a3be8c220392397c732354a95df63a527e80713268e78113875a5d94587
Instruction ID: 98f8446855592729d7e10a5667fbe29b29aa873ca2805a54b3b845b24e02b0d7
Opcode Fuzzy Hash: 8a1d3a3be8c220392397c732354a95df63a527e80713268e78113875a5d94587
Instruction Fuzzy Hash: 2FF06275211A0181EB168B26E44479D6360AFCE7E5F940715EB69476F4DF3CC18AC720

Function 00000001400A0EC4 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000001400A0F07
_set_statfp.LIBCMT ref: 00000001400A0F25
_set_statfp.LIBCMT ref: 00000001400A0F4E
_set_statfp.LIBCMT ref: 00000001400A1187

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a8e7f674e444c430dcab0a326aefe8bd211f8fcb11616e81174b6f6b026ae09c
Instruction ID: af3071e0bee92d839052dec8344f2e2b51121cf2c489282b3b45be5312fe506f
Opcode Fuzzy Hash: a8e7f674e444c430dcab0a326aefe8bd211f8fcb11616e81174b6f6b026ae09c
Instruction Fuzzy Hash: 4C81A032614A4849F6778B37B4403EAA6A1EBAD7D4F044315BB5A27AF5DB38C5C28E00

Function 0000000140092174 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400921ED
_invalid_parameter_noinfo.LIBCMT ref: 000000014009223D
_invalid_parameter_noinfo.LIBCMT ref: 0000000140092285
_invalid_parameter_noinfo.LIBCMT ref: 00000001400922BD
_invalid_parameter_noinfo.LIBCMT ref: 0000000140092330

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8fe47afb3800f68be13bbe9b63e2be9326a40284285b68905b179da7a6afdabd
Instruction ID: 7a428a4386f63e493158c0509331fd65a4757546a53b0a6f49cc4351dc459348
Opcode Fuzzy Hash: 8fe47afb3800f68be13bbe9b63e2be9326a40284285b68905b179da7a6afdabd
Instruction Fuzzy Hash: A1518532205B8496E7639F23E4603ED3BA5A75EBC4F89C051EBC8473A6DA3D8955C302

Function 00000001400ACED0 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000001400ACEF8
_set_statfp.LIBCMT ref: 00000001400ACF13
_set_statfp.LIBCMT ref: 00000001400ACF2F
_set_statfp.LIBCMT ref: 00000001400ACF6B

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bd658b213281b8180d680cb5284e660fc3441ab3d2b441db00ad661a662aa27e
Instruction ID: 910659adc1651636596cfe2fda14398b106978431f66616b18fe143b413dec5b
Opcode Fuzzy Hash: bd658b213281b8180d680cb5284e660fc3441ab3d2b441db00ad661a662aa27e
Instruction Fuzzy Hash: 82118276A34A094DF65A112BE4467E911426BFD3F0F0A0734BB7A0B7F79E3889C15A48

Function 0000000140099DD4 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,0000000140091617,?,?,00000000,00000001400918B2,?,?,?,?,8000000000000000,000000014009183E), ref: 0000000140099DF3
FlsSetValue.KERNEL32(?,?,?,0000000140091617,?,?,00000000,00000001400918B2,?,?,?,?,8000000000000000,000000014009183E), ref: 0000000140099E12
FlsSetValue.KERNEL32(?,?,?,0000000140091617,?,?,00000000,00000001400918B2,?,?,?,?,8000000000000000,000000014009183E), ref: 0000000140099E3A
FlsSetValue.KERNEL32(?,?,?,0000000140091617,?,?,00000000,00000001400918B2,?,?,?,?,8000000000000000,000000014009183E), ref: 0000000140099E4B
FlsSetValue.KERNEL32(?,?,?,0000000140091617,?,?,00000000,00000001400918B2,?,?,?,?,8000000000000000,000000014009183E), ref: 0000000140099E5C

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: ca041b53e005c77730e5b4023cff483f4379ac388898f76ba841aadf262eed56
Instruction ID: 4e2cdae51b6b0ef9d0c9a7702e45846a959b073c19d1744dbfe0150df42658a4
Opcode Fuzzy Hash: ca041b53e005c77730e5b4023cff483f4379ac388898f76ba841aadf262eed56
Instruction Fuzzy Hash: 41113D3070864141FA5AE72B96613E972925B9CBF0F184725BB3A0B6F6DE79C4518202

Function 0000000140099C68 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 0000000140099C79
FlsSetValue.KERNEL32 ref: 0000000140099C98
FlsSetValue.KERNEL32 ref: 0000000140099CC0
FlsSetValue.KERNEL32 ref: 0000000140099CD1
FlsSetValue.KERNEL32 ref: 0000000140099CE2

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 3e5c20a67329dbba8e21e5bcee7e617fd474fffe89f5f8156b1eab71d72c3704
Instruction ID: 5a762f1b3da12e99b705ebbfadf4c445ab3f8ffc203e5697425a27e4fb485252
Opcode Fuzzy Hash: 3e5c20a67329dbba8e21e5bcee7e617fd474fffe89f5f8156b1eab71d72c3704
Instruction Fuzzy Hash: 8311007024560141FE6BB77B58617F922924B8DBF0F180B25BB370B2F3EE39D8519202

Function 00000001400C1D64 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400C2043

Part of subcall function 00000001400AB70C: _invalid_parameter_noinfo.LIBCMT ref: 00000001400AB729

Strings

UTF-8, xrefs: 00000001400C1FC2
UTF-16LEUNICODE, xrefs: 00000001400C1FE1
ccs, xrefs: 00000001400C1F7E

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 0524d665bc5a06fd11eb7e2e04d7f90da3eaa764dfd4209342eddcaac0b5d37c
Instruction ID: dfb0432c6f06ff27fb8ade60ff9cbd94804fc78f1fe0fbb781c9fed0584a1649
Opcode Fuzzy Hash: 0524d665bc5a06fd11eb7e2e04d7f90da3eaa764dfd4209342eddcaac0b5d37c
Instruction Fuzzy Hash: 62814B7260C74085FB6F9F2BC1503FC2AA0A39ABC8F958029FB06976F5D339C9529701

Function 0000000140048470 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001400484DF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140048527
_Getcoll.LIBCPMT ref: 000000014004855B

Strings

bad locale name, xrefs: 0000000140048660

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: 48ac9f242940bc41e57652e659744f13fa30727a24d025037d863f02779f8363
Instruction ID: 2254c255a6c4935af6d93423b4c95e3e0c008ec596716f9ce7e504583dfb9204
Opcode Fuzzy Hash: 48ac9f242940bc41e57652e659744f13fa30727a24d025037d863f02779f8363
Instruction Fuzzy Hash: C9715C32702B408AFB16DFB6D4503DD33B6EB48B98F054526EF5D67AA9DA34C451C388

Function 000000014005B690 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 000000014005B870
__std_exception_destroy.LIBVCRUNTIME ref: 000000014005B87D

Strings

at line , xrefs: 000000014005B71A
, column , xrefs: 000000014005B748

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: 2e5234fcc3aaa90247cd826984ceeebebac9ff1b793ca4912b3fa40d38fefeb7
Instruction ID: c95716d310434b59b2a81e399601e63033a052a00854612b1375c14b18a3a36e
Opcode Fuzzy Hash: 2e5234fcc3aaa90247cd826984ceeebebac9ff1b793ca4912b3fa40d38fefeb7
Instruction Fuzzy Hash: F751DE72604B8481EB15DB2AE5843AEB721F78DBD0F504221FBA907BEADF39D081C740

Function 000000014002EA30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014002EA9E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000000014002EAE6
_Getctype.LIBCPMT ref: 000000014002EB24

Strings

bad locale name, xrefs: 000000014002EBDD

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 1bf784a48bb9dc5e36313bfe16d945f658639e91e8b5ce0241725dba8c3e9fae
Instruction ID: 49919a0638b93a0d9c349e220f20bf12f5f23e43642ce0c5e52ec5149b2b47df
Opcode Fuzzy Hash: 1bf784a48bb9dc5e36313bfe16d945f658639e91e8b5ce0241725dba8c3e9fae
Instruction Fuzzy Hash: 96511B32702B409AFB16DFA2D4903ED3375EB58788F044529EF5927AA9DF34C925D344

Function 00000001400828E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 000000014008296B

Strings

?, xrefs: 0000000140082920

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Open
String ID: ?
API String ID: 71445658-1684325040
Opcode ID: d73c2fc119a0a159e46710a9827755788a2eba32557b50d056ad65d865444428
Instruction ID: 4e8db620cbc1b91769a94bcd6e881d2b8906939414d5f1eafba696dead868338
Opcode Fuzzy Hash: d73c2fc119a0a159e46710a9827755788a2eba32557b50d056ad65d865444428
Instruction Fuzzy Hash: 5041D072618B8082EB11CB26E48439EB760FB997D4F505215FB8E43BA9DF78C184CB44

Function 000000014009C220 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000000014009C2A7
WriteFile.KERNEL32 ref: 000000014009C56E
WriteFile.KERNEL32 ref: 000000014009C5B7
GetLastError.KERNEL32 ref: 000000014009C678

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 9747b9886aa077a2834e1a796ac88b116a11c1980555fa48c7763810529486d9
Instruction ID: 735718e44f5e91c12114911fda1885aa3ecff155e1c3bdeed2142872ed253e7b
Opcode Fuzzy Hash: 9747b9886aa077a2834e1a796ac88b116a11c1980555fa48c7763810529486d9
Instruction Fuzzy Hash: 46D1FC72B10A808AEB12CF7AD4407EC37B1F348BD8F558216EF9997BA9CA34C546C740

Function 000000014009CBFC Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000000014009CD1F
GetLastError.KERNEL32 ref: 000000014009CDA9

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 7063050246c2fad88b065a933e2c6f249031a7ed32688652b8e99d20094d880a
Instruction ID: 743a2a84d553b006bec44a164e9b48346854ff6cee7a980c229786938ba229d3
Opcode Fuzzy Hash: 7063050246c2fad88b065a933e2c6f249031a7ed32688652b8e99d20094d880a
Instruction Fuzzy Hash: 1191A2B2A2065089FB62CB679480BED3BA0F74DBD8F445116FF4A67AA5DB34C485C710

Function 00000001400C3288 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001400C32C9
_invalid_parameter_noinfo.LIBCMT ref: 00000001400C3349
_invalid_parameter_noinfo.LIBCMT ref: 00000001400C339D
_get_daylight.LIBCMT ref: 00000001400C33F5

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 23c2d46af6276b08be865227d4156c69869a5f5364afc3469a4aa53254264490
Instruction ID: c4eb06b392054e80e3e2d3b0349eb777ce60f8b0d8cdd9ad56ca04f13fb0d0dd
Opcode Fuzzy Hash: 23c2d46af6276b08be865227d4156c69869a5f5364afc3469a4aa53254264490
Instruction Fuzzy Hash: B351DF3262C38086F77F5A2BD5153FD6A90E34D7D4F198525BB469B2FACA3CCA408742

Function 000000014004E11E Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a54e9a1cb11344d50727d94958118c2c4a6430c0e9c873597cf07d1822e852
Instruction ID: 5cd87b551d54bf12e46765c41e30f6003248c96073f8407b344622b368d20a9f
Opcode Fuzzy Hash: e5a54e9a1cb11344d50727d94958118c2c4a6430c0e9c873597cf07d1822e852
Instruction Fuzzy Hash: E741F83270178446FA269F67A6447E9A294AB487E4F180A35BFAD07BE7DB78C4918304

Function 0000000140085E90 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0000000140085EB0
FreeEnvironmentStringsW.KERNEL32 ref: 0000000140085FAB
RtlInitUnicodeString.NTDLL ref: 000000014008601E
RtlInitUnicodeString.NTDLL ref: 000000014008602B

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: 63d5e256d85fd567c6aa2f24b043233b31a11fa5b9e1f1fe608c5c5c2082496a
Instruction ID: 9ee951371d52096d9653f2fd91a1abf04450b78460846d13f21951c0045c0739
Opcode Fuzzy Hash: 63d5e256d85fd567c6aa2f24b043233b31a11fa5b9e1f1fe608c5c5c2082496a
Instruction Fuzzy Hash: F7519B33A14B8082EB129F26E44039DB760F798BD8F549215EB9D03BA6DF78D6E1C704

Function 0000000140042210 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00000001400BC4DC: std::_Lockit::_Lockit.LIBCPMT ref: 00000001400BC4F9
Part of subcall function 00000001400BC4DC: std::locale::_Setgloballocale.LIBCPMT ref: 00000001400BC51C

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140042251
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140042276
std::_Facet_Register.LIBCPMT ref: 0000000140042322
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140042384

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: 52f09004af13444489614d13a4beed677261be053e2b71cb6c70c7ba7eb4c573
Instruction ID: d65f8c266149f92a50ffe7e80d9563658ca8043f39de160116dfe31be92447d4
Opcode Fuzzy Hash: 52f09004af13444489614d13a4beed677261be053e2b71cb6c70c7ba7eb4c573
Instruction Fuzzy Hash: D7415832214B8081EA16DF16E8903EA77A4F78CBA4F991522AB9D077B9DF78C951C704

Function 0000000140092018 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000140092091
_invalid_parameter_noinfo.LIBCMT ref: 00000001400920F6
_invalid_parameter_noinfo.LIBCMT ref: 0000000140092132
_invalid_parameter_noinfo.LIBCMT ref: 0000000140092163

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 46041605b107bf846d44f5685209754c03f59a2c6bd87be6db18ef3a7a800cef
Instruction ID: b9da052f4a1c8645c0c669a10c0eca53c74bdbb8bd2ac94490040e784225e891
Opcode Fuzzy Hash: 46041605b107bf846d44f5685209754c03f59a2c6bd87be6db18ef3a7a800cef
Instruction Fuzzy Hash: 8B416D32104BC886E763DF23D4603ED3FA4A759BC4F49C051EBC8473A6DA3A8855C312

Function 0000000140076360 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014007638B
std::_Lockit::_Lockit.LIBCPMT ref: 00000001400763B0
std::_Facet_Register.LIBCPMT ref: 000000014007645B
Concurrency::cancel_current_task.LIBCPMT ref: 00000001400764A6

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 630083b87030d874fb98124a302e25b2be5d17abf895b295ad6d9102da189e85
Instruction ID: 3c80963576db171c177ba1fc5730fdf64f35d93e38b68416c7fec54ad968ef5d
Opcode Fuzzy Hash: 630083b87030d874fb98124a302e25b2be5d17abf895b295ad6d9102da189e85
Instruction Fuzzy Hash: 43414932214B8085FA16AB27E8503DA6760F78CBE4F581621FB9E477B9DF38C5428700

Function 00000001400764B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001400764DB
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140076500
std::_Facet_Register.LIBCPMT ref: 00000001400765AB
Concurrency::cancel_current_task.LIBCPMT ref: 00000001400765F6

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: a59cef1689774fe1fab41ed2815740ae3a49e56a25c405c4f9a4d703edcec962
Instruction ID: 15c9f317cc1556a32457209af1c7154bdf24ec9ee8daf65e76026d090249e89c
Opcode Fuzzy Hash: a59cef1689774fe1fab41ed2815740ae3a49e56a25c405c4f9a4d703edcec962
Instruction Fuzzy Hash: 48413A32214E8081FA16EF27E4503DA6760F78CBE4F481621BB9E477B9DF38C5528740

Function 0000000140055AE0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140055B0B
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140055B30

Part of subcall function 0000000140056720: std::_Lockit::_Lockit.LIBCPMT ref: 000000014005678E
Part of subcall function 0000000140056720: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000001400567D6

std::_Facet_Register.LIBCPMT ref: 0000000140055BDB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140055C26

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Locinfo::_Locinfo_ctorRegister
String ID:
API String ID: 4181401918-0
Opcode ID: 341d0c1e0db9659c00f22877e9a5ce8211df1a606b3819ad1c108b85621a30d4
Instruction ID: 495580b44bb60ffe8221b037bbc441cecc3f35ffbf9d5ccaa041f9d8bb5e3b79
Opcode Fuzzy Hash: 341d0c1e0db9659c00f22877e9a5ce8211df1a606b3819ad1c108b85621a30d4
Instruction Fuzzy Hash: 24415C32214A8085FA16EF17E8643EA77A0F78CBE4F581621BB9D477B9DF38C5518700

Function 0000000140043F00 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140043F2B
std::_Lockit::_Lockit.LIBCPMT ref: 0000000140043F50
std::_Facet_Register.LIBCPMT ref: 0000000140043FFB
Concurrency::cancel_current_task.LIBCPMT ref: 0000000140044046

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 9af72d6ad9fd38ab47eddf7528dcaacaf76fef6c26246278d57936cf75c35419
Instruction ID: bb11e2fb72f8f9207540e96e0655980bf263c009e36167cd33950d5557aee338
Opcode Fuzzy Hash: 9af72d6ad9fd38ab47eddf7528dcaacaf76fef6c26246278d57936cf75c35419
Instruction Fuzzy Hash: 83414A32214A4081FA26DF17E4903EA6770F78CBE8F481625FB9E477B9DE38C5558700

Function 00000001400BB5B0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00000001400BB5F9
GetLastError.KERNEL32 ref: 00000001400BB607
WideCharToMultiByte.KERNEL32 ref: 00000001400BB63C
GetLastError.KERNEL32 ref: 00000001400BB64A

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 34891596e761fd8460ac700fee511bf0e15182bd71cca03b29692357d58ccc2a
Instruction ID: 47b26950a7319bc93b44fdd10b38eee0aa547041d88658f082306caa57fbc3ad
Opcode Fuzzy Hash: 34891596e761fd8460ac700fee511bf0e15182bd71cca03b29692357d58ccc2a
Instruction Fuzzy Hash: EE215C76624B8487E7208F16E44475EBBB4F79DFD4F240228EB8953B64DB78C9128B00

Function 00000001400BBA9C Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000001400BBAC0
GetFileAttributesW.KERNEL32 ref: 00000001400BBACF
__std_fs_open_handle.LIBCPMT ref: 00000001400BBAF8
CloseHandle.KERNEL32 ref: 00000001400BBB0A

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: AttributesCloseErrorFileHandleLast__std_fs_open_handle
String ID:
API String ID: 833716960-0
Opcode ID: 56b2687e7590be9060b2f521e43c00ef56049a5b324cbe43c349fec2da949a14
Instruction ID: ecf8e04536506bf301bab2cbce95ce546ef55d5cb58c3ad7ac5d5ba8bfebee2f
Opcode Fuzzy Hash: 56b2687e7590be9060b2f521e43c00ef56049a5b324cbe43c349fec2da949a14
Instruction Fuzzy Hash: 6111A331224A4046EB564FABA4947BE6671EB8C7F0F501614FB7747AF9DBF8C5418B00

Function 00000001400AF04C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000001400AF078
GetCurrentThreadId.KERNEL32 ref: 00000001400AF086
GetCurrentProcessId.KERNEL32 ref: 00000001400AF092
QueryPerformanceCounter.KERNEL32 ref: 00000001400AF0A2

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 8a0a3ff48e10abca6989925f8e92c0d4ed7927e3ad9b4e6d21f331759776fbbe
Instruction ID: f32ff44ab8f647aaea5c1ba308e4dc9f7cf81c67fb3c72460e437b910a9db9d9
Opcode Fuzzy Hash: 8a0a3ff48e10abca6989925f8e92c0d4ed7927e3ad9b4e6d21f331759776fbbe
Instruction Fuzzy Hash: A0111532710B008AEB019B62E8543A833A4F71DBA8F441E21EB6D877A4EF78C1958390

Function 00000001400309D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

[json.exception., xrefs: 0000000140030B0B

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: e7c6df6e06eb819e060d3a7ba2ee612fd43aad838a7fe250ee90466a3a1256be
Instruction ID: 9239c17516455b3a448012381c2d1f074603d3bc66761de1d626d829efb37534
Opcode Fuzzy Hash: e7c6df6e06eb819e060d3a7ba2ee612fd43aad838a7fe250ee90466a3a1256be
Instruction Fuzzy Hash: 5D71C072B10B9085FB02CB7AE8503DE7761E799BD8F545225EF5917BAACB78C082C340

Function 0000000140076A40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000000140076AAE
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000000140076AF6

Strings

bad locale name, xrefs: 0000000140076BCB

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: d919f00f0427a943367ba304c046a1614d0789efb4bf88867333352a77ce6253
Instruction ID: de661e414a94730733a874623ce5d124cd788fc6ff04c6228a6b3c2b018ffba2
Opcode Fuzzy Hash: d919f00f0427a943367ba304c046a1614d0789efb4bf88867333352a77ce6253
Instruction Fuzzy Hash: 60512E32302A4099EB16EFB2D4903ED3374EB5CB88F084425EF4A67AA9DF34C965D344

Function 0000000140056720 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000000014005678E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00000001400567D6

Strings

bad locale name, xrefs: 00000001400568B5

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: f4c26f5956a8700790c51c2685bcd79b78604b35ced4f3d01a0509a6ba63debc
Instruction ID: 79aabdc48e9d7dcfcd419c141c539c529153b4b47ca512ee9535b94420428082
Opcode Fuzzy Hash: f4c26f5956a8700790c51c2685bcd79b78604b35ced4f3d01a0509a6ba63debc
Instruction Fuzzy Hash: 6B514B32302A4099FB56DFB2E4903ED33B4EB58B88F044525EB4967AA9DF35C515D344

Function 00000001400A2218 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000001400A75C0: _invalid_parameter_noinfo.LIBCMT ref: 00000001400A75F3

_get_daylight.LIBCMT ref: 00000001400A2330
_get_daylight.LIBCMT ref: 00000001400A2341

Strings

?, xrefs: 00000001400A22C1

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: f2c0b3350a0b98d8fb562b82a11e3b8b7a1d2433ae3c1a46563649a3f1cccff1
Instruction ID: 4c8615930a8e04b970d715e0e7ecd6ce3c4b969d2bbe945c248259dc4a670e9c
Opcode Fuzzy Hash: f2c0b3350a0b98d8fb562b82a11e3b8b7a1d2433ae3c1a46563649a3f1cccff1
Instruction Fuzzy Hash: 3B41C33271478056FB669B2BA4517FA6760E7A9BE4F144335BF5807AF9DB38C4C18B00

Function 000000014009C8CC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000014009C9E3
GetLastError.KERNEL32 ref: 000000014009CA05

Strings

U, xrefs: 000000014009C98F

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 0590916d9f3c9588fd2507377106b378a06cfe3691d6ecd7915443abf02f52c6
Instruction ID: ac8fc7e6074c7c9a51e373c6e66c1b2afe9ebf26f6743781aa6d0e43878e351d
Opcode Fuzzy Hash: 0590916d9f3c9588fd2507377106b378a06cfe3691d6ecd7915443abf02f52c6
Instruction Fuzzy Hash: 6041A372724A8085EB11CF26E4447EA7760F798BD4F454121EF8D877A8DB3CC441CB40

Function 00000001400A1550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 00000001400A15A4
_set_errno_from_matherr.LIBCMT ref: 00000001400A1611

Strings

exp, xrefs: 00000001400A157F

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: 923f91936fd528ad164bd700489891902ce9ad963cd2544eea48445b34140e2b
Instruction ID: c8faf32d2f23000669eabe8167213066500611c4af5ff7a223cae201b8e6b3ae
Opcode Fuzzy Hash: 923f91936fd528ad164bd700489891902ce9ad963cd2544eea48445b34140e2b
Instruction Fuzzy Hash: 0221F536B11A14CEE751DF79D4407ED37B0FB9C788F401625FA0A97B9AEB38C5818A40

Function 0000000140081E80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 0000000140081EE7

Strings

ProductName, xrefs: 0000000140081ED2
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0000000140081ED9

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: adf216c2d1b5f5292331595630b64b33fa050b190fc1c5e17533aec2785cb7d3
Instruction ID: 82c62a7f4ec79859ab1e0cf62bff8524839eff1fb1f348316490ea4113246402
Opcode Fuzzy Hash: adf216c2d1b5f5292331595630b64b33fa050b190fc1c5e17533aec2785cb7d3
Instruction Fuzzy Hash: F6111C32618B8486E7218F26F4413DAB3A4F78DB88F505225EB9847B69DFB8C155CB40

Function 00000001400B1108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00000001400B114C
RaiseException.KERNEL32 ref: 00000001400B1192

Strings

csm, xrefs: 00000001400B117F

Memory Dump Source

Source File: 00000002.00000002.2248774869.0000000140000000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_140000000_attrib.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a8459bb6fad1551cf5a45c3703ef9eb160a5f06788234bdcb96471953bc322dd
Instruction ID: 90ede0d865761f79051705b934f7b60601a23e415855fb028d7554a438b0a527
Opcode Fuzzy Hash: a8459bb6fad1551cf5a45c3703ef9eb160a5f06788234bdcb96471953bc322dd
Instruction Fuzzy Hash: 21111C32214F8482EB628F56E44039AB7B5FB88BD4F584621EF8D07B69DF39C551CB00

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00007FF684CA1719 Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 213
injectionthreadprocessCOMMON

Function 00007FF684CA1180 Relevance: 12.1, APIs: 8, Instructions: 146
sleepstringCOMMON

Function 00007FF684CA1B3C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 37
COMMON

Function 00007FF684CA15A0 Relevance: 1.4, APIs: 1, Instructions: 100
COMMON

Function 00007FF684D2DEE0 Relevance: 16.3, APIs: 5, Strings: 4, Instructions: 567
COMMON

Function 00007FF684CF14F0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 399
COMMON

Function 00007FF684CE9BE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 292
COMMON

Function 00007FF684D19A00 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 440
COMMON

Function 00007FF684CA1EA0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 138
COMMON

Function 00007FF684D41434 Relevance: 12.6, Strings: 10, Instructions: 57
COMMONLIBRARYCODE

Function 00007FF684CD2FB0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 278
COMMON

Function 00007FF684CD1E30 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 217
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre